openapi: 3.0.3
info:
  title: WithSecure™ Security Events
  description: WithSecure™ Security Events documentation.
  version: 1.0.0
tags:
  - name: antimalware scan interface
  - name: application control
  - name: browsing protection
  - name: collaboration protection
  - name: connection control
  - name: Connector
  - name: dataguard
  - name: deepguard
  - name: device control
  - name: endpoint detection and response
    description: |
      Events about Broad Context Detections (BCDs) from Endpoint Detection and Response (EDR) system. In the Elements API BCDs are available from the /incidents endpoint.
  - name: exposure management
  - name: firewall
  - name: integrity checker
  - name: product
    description: Product notification events.
  - name: real-time and manual scanning
  - name: Rollback
  - name: Server Share Protection
  - name: setting
  - name: System Events Log
  - name: tamper protection
  - name: web content control
  - name: web traffic scanning
  - name: XFence
paths:
  File Scanning:
    post:
      tags:
        - real-time and manual scanning
      summary: Malicious content was found while scanning files
      description: 'Real-time, manual or scheduled scanning found a malicious content.'
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - manualScanning
                      - fileScanning
                    description: Product feature that found an infection.
                  action:
                    type: string
                    enum:
                      - none
                      - blocked
                      - renamed
                      - deleted
                      - disinfected
                      - quarantined
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      sha1:
                        type: string
                        description: SHA1 of an infected file.
                      infectionType:
                        type: string
                        enum:
                          - virus
                          - spyware
                          - riskware
                        description: Type of an infection.
                      infectionName:
                        type: string
                        description: Infection name.
                      systemWide:
                        type: string
                        enum:
                          - true
                          - false
                        description: Infection is system wide.
                      quarantineId:
                        type: string
                        description: Quarantine ID to release object from quarantine.
                      readOnly:
                        type: string
                        enum:
                          - true
                          - false
                        description: The infected file cannot be modified.
                      rebootRequiredToDelete:
                        type: string
                        enum:
                          - true
                          - false
                        description: Reboot is required to remove the infection.
                      availableActions:
                        type: string
                        description: 'Suggested actions in response to infection. Options are block,disinfect,delete,rename,quarantine.'
                      fileScanningType:
                        type: string
                        description: Type of scanning.
                      profileName:
                        type: string
                        description: Name of a Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      recommendedAction:
                        type: string
                        description: Recommended action.
                      path:
                        type: string
                        description: Path to an infected file.
                      created:
                        type: string
                        description: File creation timestamp.
                      modified:
                        type: string
                        description: File modification timestamp.
                      size:
                        type: string
                        description: File size.
                      prevalence:
                        type: string
                        description: |
                          The prevalence rating of the file.\
                          0 - Undefined or not known.\
                          1-50 Rare files.\
                          50-100 Common files.
                      reputation:
                        type: string
                        description: |
                          The reputation rating of the file\
                          0-9 - Clean file.\
                          10-79 - Suspicious or potential unwanted (PUA) or Riskware.\
                          80-89 - Unwanted Application.\
                          90-100 - Known malicious.\
                          101-999 - Unknown.
                      url:
                        type: string
                        description: URL where a file was downloaded from.
                      creator:
                        type: string
                        description: Process that created the file.
                      creatorSha1:
                        type: string
                        description: Sha1 hash of a process that created a file.
                      container:
                        type: string
                        description: Path to a top-level archive for infections found inside archive.
                      containerSha1:
                        type: string
                        description: SHA1 of an archive.
                      containerSize:
                        type: string
                        description: Size of an archive.
                      containerMailbox:
                        type: string
                        enum:
                          - false
                          - true
                        description: True is a container of file is a mailbox.
                      subItem:
                        type: string
                        description: Path to an infected file in an archive in case action was performed on whole archive.
                      accessOperation:
                        type: string
                        enum:
                          - open-read
                          - open-write
                          - close
                          - rename
                          - delete
                        description: 'For real-time scanning, attempted operation.'
                      accessFlags:
                        type: string
                        description: 'For real-time scanning, separated by comma WIN API flags used in accessing the file.'
                      accessorHash:
                        type: string
                        description: 'For real-time scanning, sha1 hash of the accessing process.'
                      accessorPath:
                        type: string
                        description: 'For real-time scanning, process used to access the file.'
                      userName:
                        type: string
                        description: Related user name or 'System'.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                      alertType:
                        type: string
                        enum:
                          - on_access_scanner.file_infection.nothing
                          - on_access_scanner.file_infection.none
                          - on_access_scanner.file_infection.blocked
                          - on_access_scanner.file_infection.renamed
                          - on_access_scanner.file_infection.deleted
                          - on_access_scanner.file_infection.disinfected
                          - on_access_scanner.file_infection.quarantined
                        description: Type of file scanning alert.
                    required:
                      - clientTimestamp
                      - infectionName
                      - sha1
                      - userName
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                manual scanning:
                  value:
                    severity: critical
                    serverTimestamp: 1677670865589
                    txId: 0000-97df3b0443296390
                    persistenceTimestamp: 1677670866082
                    source: eicar(1).com
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: manualScanning
                    action: none
                    details:
                      alertType: on_demand_scanner.file_infection.nothing
                      availableActions: 'disinfect,delete,rename,quarantine'
                      clientTimestamp: '1677670865302'
                      created: '1677670492'
                      fileScanningType: fileInfection
                      hostIpAddress: 10.133.36.253/24
                      infectionName: EICAR_Test_File
                      modified: '1677670472'
                      path: 'C:\ProgramData\eicar(1).com'
                      prevalence: '60'
                      profileId: '73633559'
                      profileName: test_test
                      profileVersion: '1677670386'
                      recommendedAction: disinfect
                      reputation: '99'
                      sha1: 3395856ce81f2b7382dee72602f798b642f14140
                      size: '68'
                      throttledCount: '0'
                      userName: WIN10ENT-X64\Administrator
                    id: 4155e71e-0cbb-3cac-ab46-24855d55340a_0
                    device:
                      agentId: 48f4edb3-911b-46b7-8566-fd4e1a2ff757
                      clientType: computerProtectionPremium
                      id: 0
                      name: WIN10ENT-X64
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Manual scan detected infection ''EICAR_Test_File'' in file ''C:\ProgramData\eicar(1).com'''
                    description: Manual Scanning event
  EDR incident created:
    post:
      tags:
        - endpoint detection and response
      summary: EDR incident (BCD) was created
      description: A new Broad Context Detection was created.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - edr
                    description: Engine that triggered security event. Always **edr** for this events.
                  action:
                    type: string
                    enum:
                      - created
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      readableIncidentId:
                        type: string
                        description: Incident ID used in Elements portal UI.
                      incidentId:
                        type: string
                        description: Incident ID used to identify incident in API requests.
                      incidentPublicId:
                        type: string
                        description: Public ID of identified incident.
                      initialDetectionTimestamp:
                        type: string
                        description: Time of initial detection of an incident.
                      risk:
                        type: string
                        enum:
                          - medium
                          - high
                          - critical
                        description: Incident risk score.
                      clientTimestamp:
                        type: string
                        description: Timestamp when the first incident activities were identified.
                      categories:
                        type: string
                        description: Comma separated list of incident categories.
                      fingerprint:
                        type: string
                        description: Incident fingerprint that can be used to find similar incidents.
                    required:
                      - readableIncidentId
                      - incidentId
                      - risk
                      - clientTimestamp
                      - categories
                      - fingerprint
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                edr incident created:
                  value:
                    severity: critical
                    engine: edr
                    serverTimestamp: 1651578141192
                    action: created
                    txId: 0000-21d24f9cff1145c5-9bd77204-ac47-4754-aa16-18f900fb4440
                    details:
                      categories: PERSISTENCE
                      clientTimestamp: '1651578140970'
                      fingerprint: aa77e49047798bd8efe373fdcf7bb65954083664
                      incidentId: 9f003dcb-528b-43e2-8ea5-f09d7eda2fe9
                      incidentPublicId: 11355-92710
                      initialDetectionTimestamp: '1651574700000'
                      resolution: UNCONFIRMED
                      risk: MEDIUM
                    id: 7482f9eb-e9ba-3953-a099-f24672a64d37_0
                    source: ''
                    device:
                      agentId: f4aaba09-804c-45b5-b4c7-1600c27389c7
                      clientType: computerProtectionPremiumPlusRdr
                      id: 17589954
                      name: DESKTOP-L37F6GG
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: A new incident '11355-92710' was created
                    description: Endpoint Detection and Response (EDR) event
  EDR incident closed:
    post:
      tags:
        - endpoint detection and response
      summary: EDR incident (BCD) was closed
      description: A Broad Context Detection was closed.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - edr
                    description: Engine that triggered security event. Always **edr** for this events.
                  action:
                    type: string
                    enum:
                      - closed
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      readableIncidentId:
                        type: string
                        description: Incident ID used in Elements portal UI.
                      incidentId:
                        type: string
                        description: Incident ID used to identify incident in API requests.
                      resolution:
                        type: string
                        description: Incident resolution status.
                    required:
                      - readableIncidentId
                      - incidentId
                      - resolution
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                edr incident closed:
                  value:
                    severity: info
                    engine: edr
                    serverTimestamp: 1678195336822
                    action: closed
                    txId: 0000-8c51558823d64d6d-1e1a5ae7-a3f4-42a8-9001-d527abcec69a
                    details:
                      categories: MALWARE
                      clientTimestamp: '1678195069000'
                      fingerprint: ea769f8c21c621fc1e32b287ce4197b2f9643db3
                      incidentId: 064eb177-94b0-4873-94a6-35a8ea049ac8
                      incidentPublicId: 3599-3201422
                      initialDetectionTimestamp: '1678195335455'
                      mergedTo: 2ae68b31-d858-4d8b-9351-ecf5f8a6fc5d
                      resolution: MERGED
                      risk: MEDIUM
                    id: ab3bcb62-2efe-3e1f-9f2c-4c0c6965bee9_0
                    persistenceTimestamp: 1678195337677
                    source: ''
                    device:
                      agentId: 11a1dd6e-9b53-4708-b469-4d711b2109a5
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: ta_rvmmvlv9884
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: An incident '3599-3201422' was closed
                    description: Endpoint Detection and Response (EDR) event
  EDR incident merged:
    post:
      tags:
        - endpoint detection and response
      summary: EDR incident (BCD) was merged to another incident
      description: A Broad Context Detection was merged with another BCD.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - edr
                    description: Engine that triggered security event. Always **edr** for this events.
                  action:
                    type: string
                    enum:
                      - merged
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      readableIncidentId:
                        type: string
                        description: Incident ID used in Elements portal UI.
                      incidentId:
                        type: string
                        description: Incident ID used to identify incident in API requests.
                      mergedTo:
                        type: string
                        description: ID of an incident to what the current incident was merged to.
                    required:
                      - readableIncidentId
                      - incidentId
                      - mergedTo
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                edr incident merged:
                  value:
                    severity: info
                    engine: edr
                    serverTimestamp: 1678195336822
                    action: closed
                    txId: 0000-8c51558823d64d6d-1e1a5ae7-a3f4-42a8-9001-d527abcec69a
                    details:
                      categories: MALWARE
                      clientTimestamp: '1678195069000'
                      fingerprint: ea769f8c21c621fc1e32b287ce4197b2f9643db3
                      incidentId: 064eb177-94b0-4873-94a6-35a8ea049ac8
                      incidentPublicId: 3599-3201422
                      initialDetectionTimestamp: '1678195335455'
                      mergedTo: 2ae68b31-d858-4d8b-9351-ecf5f8a6fc5d
                      resolution: MERGED
                      risk: MEDIUM
                    id: ab3bcb62-2efe-3e1f-9f2c-4c0c6965bee9_0
                    persistenceTimestamp: 1678195337677
                    source: ''
                    device:
                      agentId: 11a1dd6e-9b53-4708-b469-4d711b2109a5
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: ta_rvmmvlv9884
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: An incident '3599-3201422' was merged with incident '2ae68b31-d858-4d8b-9351-ecf5f8a6fc5d'
                    description: Endpoint Detection and Response (EDR) event
  EDR incident updated:
    post:
      tags:
        - endpoint detection and response
      summary: EDR incident (BCD) was updated
      description: A Broad Context Detection was updated.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - edr
                    description: Engine that triggered security event. Always **edr** for this events.
                  action:
                    type: string
                    enum:
                      - updated
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      readableIncidentId:
                        type: string
                        description: Incident ID used in Elements portal UI.
                      incidentId:
                        type: string
                        description: Incident ID used to identify incident in API requests.
                      incidentPublicId:
                        type: string
                        description: Public ID of identified incident.
                      initialDetectionTimestamp:
                        type: string
                        description: Time of initial detection of an incident.
                      risk:
                        type: string
                        enum:
                          - medium
                          - high
                          - critical
                        description: Incident risk score.
                      clientTimestamp:
                        type: string
                        description: Timestamp when the first incident activities were identified.
                      categories:
                        type: string
                        description: Comma separated list of incident categories.
                      fingerprint:
                        type: string
                        description: Incident fingerprint that can be used to find similar incidents.
                    required:
                      - readableIncidentId
                      - incidentId
                      - risk
                      - clientTimestamp
                      - categories
                      - fingerprint
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                edr incident created:
                  value:
                    id: e482802a-9673-4c66-b4ae-a994f47065e2_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 5440029
                      name: alertsSpecAlertsAurora2019-6-25-23-59-26-609
                      agentId: 0ea88ee3-1d02-4f44-af7d-23421a565efa
                    account:
                      uuid: fdc64c3f-2c70-481a-ad87-bf2c9157baf8
                      name: dataguard-upstream
                      orgPath: 00000000-0000-0000-0000-000000000000/9bd0a656-4ebf-4bf6-93af-0a4f75b0ed53/fdc64c3f-2c70-481a-ad87-bf2c9157baf8/
                    subscription:
                      key: UXUD-T933-8V8B-X89E-6X9B
                    severity: warning
                    engine: edr
                    source: ''
                    action: updated
                    txId: 0000-613fc6c4723f4246
                    details:
                      incidentPublicId: 3599-2499305
                      initialDetectionTimestamp: '1645545667391'
                      risk: MEDIUM
                      categories: MALWARE
                      incidentId: 12128759-f547-47ae-b20d-692fd7352948
                      userName: NT AUTHORITY\SYSTEM
                      clientTimestamp: '1645545266000'
                      resolution: UNCONFIRMED
                      userSam: NT AUTHORITY\SYSTEM
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 0ea88ee3-1d02-4f44-af7d-23421a565efa
                      name: alertsSpecAlertsAurora2019-6-25-23-59-26-609
                    fingerprint:
                      similarity: 96yearYwW+sfyUrg
                    message: An incident '3599-2499305' was updated
                    description: Endpoint Detection and Response (EDR) event
  EDR cloud incident created:
    post:
      tags:
        - endpoint detection and response
      summary: Cloud incident (BCD) was created or updated
      description: Broad Context Detection was created or updated
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - cloudIdentityAzure
                      - cloudWorkloadAzure
                      - cloud
                    description: |
                      Engine that triggered security event. **Note:** The value `cloud` is deprecated.
                  action:
                    type: string
                    enum:
                      - created
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      incidentPublicId:
                        type: string
                        description: Incident ID used in Elements portal UI.
                      cloudProvider:
                        type: string
                        enum:
                          - AWS
                          - AZURE
                        description: Name of cloud provider
                      cloudProviderTenantId:
                        type: string
                        description: Cloud provider tenant ID
                      initialDetectionTimestamp:
                        type: string
                        description: Timestamp of the initial detection
                      incidentId:
                        type: string
                        description: Incident ID used to identify incident in API requests.
                    required:
                      - readableIncidentId
                      - incidentId
                      - mergedTo
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                cloud incident:
                  value:
                    id: e482802a-9673-4c66-b4ae-a994f47065e2_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 5440029
                      name: alertsSpecAlertsAurora2019-6-25-23-59-26-609
                      agentId: 0ea88ee3-1d02-4f44-af7d-23421a565efa
                    account:
                      uuid: fdc64c3f-2c70-481a-ad87-bf2c9157baf8
                      name: dataguard-upstream
                      orgPath: 00000000-0000-0000-0000-000000000000/9bd0a656-4ebf-4bf6-93af-0a4f75b0ed53/fdc64c3f-2c70-481a-ad87-bf2c9157baf8/
                    subscription:
                      key: UXUD-T933-8V8B-X89E-6X9B
                    severity: warning
                    engine: cloudWorkloadAzure
                    source: ''
                    action: created
                    txId: 0000-613fc6c4723f4246
                    details:
                      incidentPublicId: 7023995-112049
                      cloudProvider: AZURE
                      cloudProviderTenantId: '286741534869'
                      initialDetectionTimestamp: '1701338213153'
                      fingerprint: de12a7128fd446bce5d2e618dac95af79c2a9930
                      risk: MEDIUM
                      categories: CLOUD
                      incidentId: 038fdc05-fed8-4101-b5bb-fccd53eeaca2
                      resolution: UNCONFIRMED
                    message: 'Cloud incident (BCD) was created. Incident type: "Azure workload".'
                    description: Azure workload cloud incident event
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 0ea88ee3-1d02-4f44-af7d-23421a565efa
                      name: alertsSpecAlertsAurora2019-6-25-23-59-26-609
                    fingerprint:
                      similarity: VUrv+LAx49PjHcmJ
  DataGuard:
    post:
      tags:
        - dataguard
      summary: DataGuard blocked access to user data
      description: DataGuard blocked access to user data.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - dataGuard
                    description: Engine that triggered security event. Always **dataGuard** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                      - none
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      filePath:
                        type: string
                        description: Path to an executable that made attempt to access protected data.
                      targetData:
                        type: string
                        description: Path to protected data that was tried to be accessed.
                      initiatorHash:
                        type: string
                        description: Hash of the file that initiated the alert.
                      vaultId:
                        type: string
                        description: Internal field with ID of the protected vault.
                      alertType:
                        type: string
                        enum:
                          - access_control.file.reported
                        description: Type of DataGuard event.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - filePath
                      - targetData
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                dataguard example:
                  value:
                    severity: warning
                    serverTimestamp: 1672760690854
                    txId: 0000-9dfc2a95339160cd
                    persistenceTimestamp: 1672760691579
                    source: rw_test.exe
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: dataGuard
                    action: blocked
                    details:
                      alertType: access_control.file.block
                      clientTimestamp: '1672759897272'
                      filePath: 'C:\Users\gtn-admin\Downloads\rw_test.exe'
                      hostIpAddress: 192.168.178.128/24
                      initiatorHash: 14bc39cbc240d0a9554f3f7e8ed19cca64592486
                      profileId: '65354248'
                      profileName: 000_test_profile
                      profileVersion: '1672730025'
                      targetData: 'C:\Users\gtn-admin\Pictures\1 - Copy (2).txt'
                      throttledCount: '0'
                      userName: DESKTOP-L37F6GG\gtn-admin
                      vaultId: '0'
                    id: e731484a-647d-3e2c-b233-5b111e781e8d_0
                    device:
                      agentId: e7c1da66-1e7e-4eb0-8aed-f9bce7c8d91a
                      clientType: computerProtectionPremium
                      id: 19019826
                      name: DESKTOP-L37F6GG
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'DataGuard blocked access to ''C:\Users\gtn-admin\Pictures\1 - Copy (2).txt'''
                    description: DataGuard event
  Server Share Protection:
    post:
      tags:
        - Server Share Protection
      summary: Server Share Protection detected suspicious activity
      description: Server Share Protection prevented malicious modification on the server.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - activityMonitor
                    description: Engine that triggered security event. Always **activityMonitor** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      affectedFiles:
                        type: string
                        description: List of affected files.
                      userSid:
                        type: string
                        description: SID of the user.
                      fullUsername:
                        type: string
                        description: Full username that is logged in on a system where event happened.
                      affectedSharedFolders:
                        type: string
                        description: Shared folders affected by the activity.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - activity_monitor.server_share_protection.backup_folder_error
                          - activity_monitor.server_share_protection.detected
                          - activity_monitor.server_share_protection.restored
                          - activity_monitor.server_share_protection.restored_from_quarantine
                        description: Type of alert.
                      items:
                        type: string
                        description: List of items that are restored from quarantine. Only for **activity_monitor.server_share_protection.restored_from_quarantine**.
                      backupFolder:
                        type: string
                        description: Path to affected backup folder. * Only for alert type *activity_monitor.server_share_protection.backup_folder_error*
                      isQuarantineAllowed:
                        type: string
                        description: Are reverted files stored in quarantine or not. * Only for alert type *activity_monitor.restored.detected*
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - clientTimestamp
              examples:
                detected:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                      osType: win_srv
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585580
                      name: Macias_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: critical
                    engine: activityMonitor
                    source: 'C:\shared_data\, D:\other_folder'
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    details:
                      affectedFiles: '[{"filename":"C:\\shared_data\\file1.txt"},{"filename":"C:\\shared_data\\file2.txt"},{"filename":"D:\\other_folder\\file3.log"}]'
                      userSid: S-1-5-21-3260708019-3667292800-1442550518-1000
                      fullUsername: DF\test_user
                      affectedSharedFolders: '["C:\\shared_data\\","D:\\other_folder"]'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F6GG\gtn-admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.server_share_protection.detected
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    reporting:
                      source: 'C:\shared_data\, D:\other_folder'
                      timestamp: 1589373818926
                    target:
                      id: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                      name: demo-online-device
                    fingerprint:
                      similarity: cop0fUKsZa3ooKVl
                    message: 'Malware from another computer within your network has infected the shared folder and changed files there. Affected shared folders: ''C:\shared_data\file1.txt'', ''C:\shared_data\file2.txt'', ''D:\other_folder\file3.log'''
                    description: Server Share Protection event
                restored:
                  value:
                    severity: info
                    serverTimestamp: 1678087456605
                    txId: 0000-eac0a8a3ba3b3615
                    persistenceTimestamp: 1678087458363
                    source: ''
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: activityMonitor
                    action: reported
                    details:
                      alertType: activity_monitor.server_share_protection.restored
                      clientTimestamp: '1678087454533'
                      hostIpAddress: 192.168.30.132/24
                      profileId: '6938825'
                      profileName: test-sop-own-profile
                      profileVersion: '1618492209'
                      throttledCount: '0'
                      userName: test\test
                    id: a9263ed5-d14d-3fbf-a4c7-a2aefb100730_0
                    device:
                      agentId: 6b3c4ad8-798a-493c-8a58-37ab75167ccc
                      clientType: computerProtection
                      id: 2
                      name: TEST
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: Changed files in the shared folder have been restored successfully.
                    description: Server Share Protection event
                restored from quarantine:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585580
                      name: Macias_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: info
                    engine: activityMonitor
                    source: ''
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    details:
                      items: '["c:\\detect\\1.txt","c:\\detect\\am_detection_01","c:\\detect\\am_detection_02"]'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F6GG\gtn-admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.server_share_protection.restored_from_quarantine
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                      name: demo-online-device
                    fingerprint:
                      similarity: cop0fUKsZa3ooKVl
                    message: 'Files have been restored from quarantine: ''c:\detect\1.txt'', ''c:\detect\am_detection_01'', ''c:\detect\am_detection_02'''
                    description: Server Share Protection event
                backup folder error:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb26c62
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585180
                      name: test_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f201cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: warning
                    engine: activityMonitor
                    source: 'C:\MyBackups'
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    tenant: '478444'
                    details:
                      backupFolder: 'C:\MyBackups'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F42GG\admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.server_share_protection.backup_folder_error
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    message: 'Backup folder error in ''C:\MyBackups'' on device ''DESKTOP-OSI09NE'''
                    description: Server Share Protection event
  Rollback:
    post:
      tags:
        - Rollback
      summary: Rollback detected suspicious activity
      description: Rollback prevented malicious modification
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - activityMonitorClientProtection
                    description: Engine that triggered security event. Always **activityMonitorClientProtection** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - activity_monitor.client_protection.backup_folder_error
                          - activity_monitor.client_protection.detected
                          - activity_monitor.client_protection.restored
                          - activity_monitor.client_protection.restored_from_quarantine
                        description: Type of alert.
                      items:
                        type: string
                        description: List of items that are restored from quarantine. * Only for alert type **activity_monitor.client_protection.restored_from_quarantine**.
                      backupFolder:
                        type: string
                        description: Path to affected backup folder. * Only for alert type *activity_monitor.client_protection.backup_folder_error*
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                      processOperations:
                        type: string
                        description: List of process operations. JSON object wrapped into a string. * Only for alert type *activity_monitor.client_protection.detected*
                      affectedFiles:
                        type: string
                        description: List of affected files. JSON object wrapped into a string. * Only for alert type *activity_monitor.client_protection.detected*
                      registryOperations:
                        type: string
                        description: List of registry operations. JSON object wrapped into a string. * Only for alert type *activity_monitor.client_protection.detected*
                      isQuarantineAllowed:
                        type: string
                        description: Are reverted files stored in quarantine or not. * Only for alert type *activity_monitor.restored.detected*
                    required:
                      - clientTimestamp
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - clientTimestamp
              examples:
                detected:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585580
                      name: Macias_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: critical
                    engine: activityMonitorClientProtection
                    source: ''
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    details:
                      processOperations: '{"createdProcesses":[{"sourcePath":"c:\\totalled\\totalled64.exe","targetCmdLine":"","targetHash":"AF06D95C14EE722E96D61E3C3CBCEB6CC6991DE9","targetPath":"c:\\test\\test.exe"},{"sourcePath":"c:\\totalled\\totalled64.exe","targetCmdLine":"\"C:\\test\\test.exe\" ","targetHash":"AF06D95C14EE722E96D61E3C3CBCEB6CC6991DE9","targetPath":"c:\\test\\test.exe"}]}'
                      affectedFiles: '[{"filename":"C:\\shared_data\\file1.txt"},{"filename":"C:\\shared_data\\file2.txt"},{"filename":"D:\\other_folder\\file3.log"}]'
                      registryOperations: '{"createdKeys":["HKLM\\SOFTWARE\\test\\sub key"],"createdValues":[{"key":"HKLM\\SOFTWARE\\test","value":{"data":"","name":"new added","type":"REG_SZ"}}],"deletedValues":[{"key":"HKLM\\SOFTWARE\\Sonic\\AuthorScript\\Profiles\\DVD\\Audio\\RequiredCapabilities","value":{"data":"{C1A7BF6C-0059-4BFA-94EF-EF747A768D52}","name":"{08AF4AC1-F3F2-4C74-9DCF-37F2EC79F826}","type":"REG_SZ"}}],"modifiedValues":[{"key":"HKLM\\SOFTWARE\\test","value":{"data":0,"name":"dword","type":"REG_DWORD"}},{"key":"HKLM\\SOFTWARE\\test","value":{"data":"000","name":"string_value","type":"REG_SZ"}}]}'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F6GG\gtn-admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.client_protection.detected
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                      name: demo-online-device
                    fingerprint:
                      similarity: UXDfsM89Hkw1
                    message: 'Action: "reported"'
                    description: Client Protection event
                restored:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585580
                      name: Macias_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: info
                    engine: activityMonitorClientProtection
                    source: ''
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    details:
                      isQuarantineAllowed: 'true'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F6GG\gtn-admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.client_protection.restored
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                      name: demo-online-device
                    fingerprint:
                      similarity: UXDfsM89Hkw1
                    message: 'Action: "reported"'
                    description: Client Protection event
                restored from quarantine:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585580
                      name: Macias_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: info
                    engine: activityMonitorClientProtection
                    source: ''
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    details:
                      items: '["c:\\detect\\1.txt","c:\\detect\\am_detection_01","c:\\detect\\am_detection_02"]'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F6GG\gtn-admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.client_protection.restored_from_quarantine
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 6daf8688-62d9-435a-b4bd-56cabdb76c62
                      name: demo-online-device
                    fingerprint:
                      similarity: UXDfsM89Hkw1
                    message: 'Action: "reported"'
                    description: Client Protection event
                backup folder error:
                  value:
                    id: e236fae0-bd1e-4d25-8ee9-4e67fdd3bb3d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 3360492
                      name: DESKTOP-OSI09NE
                      alias: demo-online-device
                      agentId: 6daf8688-62d9-435a-b4bd-56cabdb26c62
                    account:
                      uuid: 4da01059-b1c6-4afb-834a-d62799585180
                      name: test_company01
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f201cea1dc3/4da01059-b1c6-4afb-834a-d62799585580/
                    subscription:
                      key: 952H-HV4U-IZPM-AFG9-RNG2
                    severity: warning
                    engine: activityMonitor
                    source: 'C:\MyBackups'
                    action: reported
                    txId: 0000-5a5295dca9f2d36a
                    tenant: '478444'
                    details:
                      backupFolder: 'C:\MyBackups'
                      profileName: 000_other_test
                      hostIpAddress: 192.168.178.128/24
                      userName: DESKTOP-L37F42GG\admin
                      profileId: '51723218'
                      profileVersion: '1655885669'
                      alertType: activity_monitor.server_share_protection.backup_folder_error
                      throttledCount: '3423'
                      clientTimestamp: '1660728158216'
                    message: 'Backup folder error in ''C:\MyBackups'' on device ''DESKTOP-OSI09NE'''
                    description: Server Share Protection event
  AMSI:
    post:
      tags:
        - antimalware scan interface
      summary: AMSI detected harmful content
      description: Microsoft antimalware scan interface detected harmful content.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity rating.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - AMSI
                    description: Engine that triggered security event. Always **AMSI** for these events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      appName:
                        type: string
                        description: 'Name, version, or GUID string of the blocked application.'
                      contentName:
                        type: string
                        description: 'Filename, URL, unique script ID, or similar of the content.'
                      infectionName:
                        type: string
                        description: Name of the infection.
                      path:
                        type: string
                        description: The path to the parent process that called AMSI scan.
                      sha1:
                        type: string
                        description: SHA1 of the infected file.
                      alertType:
                        type: string
                        enum:
                          - AMSI
                        description: 'Alert type, always **AMSI** for this type of event.'
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                amsi infection:
                  value:
                    severity: warning
                    serverTimestamp: 1678195081729
                    txId: 0000-153e807091c80268
                    persistenceTimestamp: 1678195082974
                    source: JScript
                    subscription:
                      id: b53a169f-ccf2-4390-acf4-73ba063f67a8
                    engine: AMSI
                    action: blocked
                    details:
                      alertType: amsi.infection.block
                      appName: JScript
                      clientTimestamp: '1678195078575'
                      contentName: 'C:\Temp-Scan-AMSI\infected.js'
                      hostIpAddress: 10.61.40.32/22
                      infectionName: 'Testfile:JS/WithSecure_testfile.D'
                      path: 'C:\Windows\SysWOW64\cscript.exe'
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1675782455'
                      sha1: 1aef59dac1e2328b402d6fee5b5f76439ce98f43
                      throttledCount: '0'
                      userName: DESKTOP-1FHRKR9\tadmin
                    id: f9df27ec-ead4-3d55-87b9-4b9d59c48091_0
                    device:
                      agentId: c07b9280-f878-47e8-9222-cc4dee1c224d
                      clientType: computerProtectionPremium
                      id: 0
                      name: ta_test3235
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: 'AMSI detected virus in ''C:\Temp-Scan-AMSI\infected.js'''
                    description: Antimalware Scan Interface (AMSI) event
  Connector:
    post:
      tags:
        - Connector
      summary: Connector content is missing or outdated
      description: Connector content is missing or outdated
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - connector
                    description: Engine that triggered security event. Always **connector** for this events.
                  action:
                    type: string
                    enum:
                      - none
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - pmp.engine.updates.outdated
                          - pmp.swup_db.outdated
                          - pmp.swup_db_missing.nothing
                        description: Type of DataGuard event.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                      daysFromLastUpdate:
                        type: string
                        description: How many days are passed since last database update. * Valid only for alert types *pmp.engine.updates.outdated* and *pmp.swup_db.outdated*
                    required:
                      - clientTimestamp
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                engine updates are outdated:
                  value:
                    id: connector-updates-outdated_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 5578132
                      name: ta_5539
                      agentId: badd657b-7261-471b-83fa-9e7cdc572899
                    account:
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                    subscription:
                      key: 4WDQ-UKRP-F9KK-JA7Z-693Y
                    severity: critical
                    engine: connector
                    source: ''
                    action: none
                    txId: 0000-96195534415f7995
                    details:
                      daysFromLastUpdate: '5'
                      profileName: connector-open
                      hostIpAddress: 'fe80::e09a:970a:a01c:ca1a/64'
                      userName: DESKTOP-V94MVCO\glean
                      profileId: '19325830'
                      profileVersion: '1604055983'
                      clientTimestamp: '1604325845800'
                      alertType: pmp.engine.updates.outdated
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: badd657b-7261-471b-83fa-9e7cdc572899
                      name: ta_5539
                    message: 'Databases are old: the latest database file is ''5'' days old'
                    description: Elements Connector event
                Software Updater database is outdated:
                  value:
                    id: connector-swup-db-outdated_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 5578132
                      name: ta_5539
                      agentId: badd657b-7261-471b-83fa-9e7cdc572899
                    account:
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                    subscription:
                      key: 4WDQ-UKRP-F9KK-JA7Z-693Y
                    severity: critical
                    engine: connector
                    source: ''
                    action: none
                    txId: 0000-96195534415f7995
                    details:
                      daysFromLastUpdate: '6'
                      profileName: connector-open
                      hostIpAddress: 'fe80::e09a:970a:a01c:ca1a/64'
                      userName: DESKTOP-V94MVCO\glean
                      profileId: '19325830'
                      profileVersion: '1604055983'
                      clientTimestamp: '1604325845801'
                      alertType: pmp.swup_db.outdated
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: badd657b-7261-471b-83fa-9e7cdc572899
                      name: ta_5539
                    message: Software updater database is outdated on device 'ta_5539' (last update 6 days ago)
                    description: Elements Connector event
                Software Updater database is missing:
                  value:
                    id: connector-swup-db-missing_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    device:
                      id: 5578132
                      name: ta_5539
                      agentId: badd657b-7261-471b-83fa-9e7cdc572899
                    account:
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                    subscription:
                      key: 4WDQ-UKRP-F9KK-JA7Z-693Y
                    severity: critical
                    engine: connector
                    source: ''
                    action: none
                    txId: 0000-96195534415f7995
                    details:
                      profileName: connector-open
                      hostIpAddress: 'fe80::e09a:970a:a01c:ca1a/64'
                      userName: DESKTOP-V94MVCO\glean
                      profileId: '19325830'
                      profileVersion: '1604055983'
                      clientTimestamp: '1604325845802'
                      alertType: pmp.swup_db_missing.nothing
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: badd657b-7261-471b-83fa-9e7cdc572899
                      name: ta_5539
                    message: Software updater database is missing on device 'ta_5539'
                    description: Elements Connector event
  Application control:
    post:
      tags:
        - application control
      summary: Application control triggered a rule
      description: Application control event description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity rating.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - applicationControl
                    description: Engine that triggered security event. Always **applicationControl** for these events.
                  action:
                    type: string
                    enum:
                      - blocked
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      installerPath:
                        type: string
                        description: Path to the MSI package in the host file system.
                      installerSha1:
                        type: string
                        description: SHA1 hash of the MSI package.
                      installerSignature:
                        type: string
                        description: Signature information of the MSI package.
                      installerSubject:
                        type: string
                        description: Subject name defined in the MSI package.
                      installerReputation:
                        type: string
                        description: Reputation grade of the MSI package.
                      installerPrevalence:
                        type: string
                        description: Prevalence rating of the MSI package.
                      parentPath:
                        type: string
                        description: Path to the parent file which started or loaded the target file which caused the alert.
                      parentCommandLine:
                        type: string
                        description: Parent command line that caused the alert.
                      parentReputation:
                        type: string
                        description: Reputation grade of the parent file that started the file that caused the alert.
                      parentPrevalence:
                        type: string
                        description: Prevalence rating of the parent file that started the file that caused the alert.
                      profileId:
                        type: string
                        description: Profile ID where the rule is defined.
                      profileName:
                        type: string
                        description: Name of the profile where the rule is defined.
                      profileVersion:
                        type: string
                        description: Profile version where the rule is defined.
                      ruleEvent:
                        type: string
                        description: Rule event.
                      ruleId:
                        type: string
                        description: Rule ID from AC settings.
                      ruleName:
                        type: string
                        description: Rule name from AC settings.
                      targetCommandLine:
                        type: string
                        description: Command line which were used to start the executable target file caused the alert.
                      targetCopyrightText:
                        type: string
                        description: Target file copyright text.
                      targetFileDescription:
                        type: string
                        description: Target file description.
                      targetFileVersion:
                        type: string
                        description: Target file version.
                      targetPath:
                        type: string
                        description: Path to the target file in file system.
                      targetProductName:
                        type: string
                        description: Product name which the target executable belongs to.
                      targetProductVersion:
                        type: string
                        description: Product version.
                      targetSha1:
                        type: string
                        description: SHA1 of the target file.
                      targetSha256:
                        type: string
                        description: SHA256 of the target file.
                      targetReputation:
                        type: string
                        description: Reputation grade of the target file that caused the alert.
                      targetPrevalence:
                        type: string
                        description: Prevalence rating of the file that caused the alert.
                      targetSignatureSignerName:
                        type: string
                        description: Name of the signer defined in the certificate.
                      targetVersionCompanyName:
                        type: string
                        description: Name of the company produced the target executable.
                      alertType:
                        type: string
                        enum:
                          - applicationControl
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - ruleId
                      - ruleName
                      - ruleEvent
                      - profileId
                      - profileVersion
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                application control:
                  value:
                    severity: warning
                    serverTimestamp: 1663676518062
                    txId: 0000-a2a558065bcd593b
                    persistenceTimestamp: 1663676518868
                    source: Microsoft® Windows® Operating System
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: applicationControl
                    action: blocked
                    details:
                      alertType: application_control.application_start.block
                      clientTimestamp: '1663672890528'
                      hostIpAddress: 192.168.88.128/24
                      parentCommandLine: '"C:\Windows\system32\wscript.exe" c:\temp\test.vbs'
                      parentPath: 'C:\Windows\System32\wscript.exe'
                      parentPrevalence: '1'
                      parentReputation: '150'
                      profileId: '35939769'
                      profileName: 000_appcontrol_enabled
                      profileVersion: '1663656119'
                      ruleEvent: application_start
                      ruleId: c881f6d6-d4a5-46b9-9b2d-108d048ae022
                      ruleName: Block cmd started from wscript
                      targetCommandLine: '"C:\Windows\System32\cmd.exe" /C DEL c:\Test\Mail*.* /F /S /Q '
                      targetCopyrightText: © Microsoft Corporation. All rights reserved.
                      targetFileDescription: Windows Command Processor
                      targetFileVersion: 10.0.18362.449
                      targetPath: 'C:\Windows\System32\cmd.exe'
                      targetPrevalence: '19'
                      targetProductName: Microsoft® Windows® Operating System
                      targetProductVersion: 10.0.18362.449
                      targetReputation: '150'
                      targetSha1: 8dca9749cd48d286950e7a9fa1088c937cbccad4
                      targetSignatureSignerName: Microsoft Windows
                      targetVersionCompanyName: Microsoft Corporation
                      throttledCount: '2'
                      userName: DESKTOP-TA69713\gtn-admin
                    id: 1480ca52-b6b3-37fc-8ef7-49b3721500d9_0
                    device:
                      agentId: 791611fd-ec00-4155-adb8-3f181a9c4b1f
                      clientType: computerProtectionPremium
                      id: 18488990
                      name: DESKTOP-TA69713
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Application Control blocked application_start of ''C:\Windows\System32\cmd.exe'' based on rule ''Block cmd started from wscript'''
                    description: Application Control event
  Application control error:
    post:
      tags:
        - application control
      summary: Application control could not read a rule
      description: Application control error event description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity rating.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - applicationControl
                    description: Engine that triggered security event. Always **applicationControl** for these events.
                  action:
                    type: string
                    enum:
                      - none
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      profileId:
                        type: string
                        description: Profile ID where the rule is defined.
                      profileVersion:
                        type: string
                        description: Profile version where the rule is defined.
                      ruleEvent:
                        type: string
                        description: Rule event.
                      ruleId:
                        type: string
                        description: Rule ID from application control settings.
                      ruleName:
                        type: string
                        description: Rule name from application control settings.
                      errorMessage:
                        type: string
                        description: Text message describing the error.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - ruleId
                      - ruleName
                      - ruleEvent
                      - profileId
                      - profileVersion
                      - errorMessage
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                application control error:
                  value:
                    severity: critical
                    serverTimestamp: 1665084256989
                    txId: 0000-f7aa98a0aa37e512
                    acknowledgementStatus:
                      acknowledgedBy: test-sop
                      acknowledgerOrgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/
                      isAcknowledged: true
                      timestamp: 1665730534448
                    persistenceTimestamp: 1665084259940
                    source: ''
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: applicationControl
                    action: none
                    details:
                      alertType: application_control.settings.error
                      clientTimestamp: '1665084249497'
                      errorMessage: Expected valid flag value. The rule is ignored.
                      hostIpAddress: 10.61.33.185/25
                      profileId: '1854751'
                      profileName: 000test-test31
                      profileVersion: '1648650913'
                      ruleEvent: settings
                      ruleId: 49dc7cb9-224a-4786-8670-d23559542dfa
                      throttledCount: '0'
                      userName: DESKTOP-1FHRKR9\tadmin
                    id: f0ed43bf-63ce-31b8-8d77-5c9853d2c44a_0
                    device:
                      agentId: 12080459-7d32-4884-a529-f175a207a4d8
                      alias: Bitlocker Tests 007
                      clientType: computerProtectionPremium
                      id: 18545037
                      name: DESKTOP-1FHRKR9
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: Application Control ignored rule 'settings'
                    description: Application Control event
  Browsing protection harmful or suspicious page blocked:
    post:
      tags:
        - browsing protection
      summary: Browsing protection blocked a web page
      description: Browsing protection blocked a web page because this page is rated either harmful or suspicious.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity rating.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - reputationBasedBrowsing
                    description: Engine that triggered security event. Always **reputationBasedBrowsing** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      process:
                        type: string
                        description: Process where the suspicious page was opened.
                      reason:
                        type: string
                        enum:
                          - BP_Harmful
                          - BP_Suspicious
                        description: Type of blocked page.
                      url:
                        type: string
                        description: URL of the suspicious page.
                      alertType:
                        type: string
                        enum:
                          - online_safety.harmful_page.block
                          - online_safety.illegal_page.block
                          - online_safety.suspicious_page.block
                        description: Online safety alert type.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - process
                      - reason
                      - url
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                reputation based browsing:
                  value:
                    severity: warning
                    serverTimestamp: 1677851790806
                    txId: 0000-7b5c8de7f4faed29
                    persistenceTimestamp: 1677851791765
                    source: 'hxxp://unsafe.fstestdomain.com'
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: reputationBasedBrowsing
                    action: blocked
                    details:
                      alertType: online_safety.harmful_page.block
                      clientTimestamp: '1677848190005'
                      hostIpAddress: 10.61.33.187/25
                      process: firefox.exe
                      profileId: '56358066'
                      profileName: test profile
                      profileVersion: '1677506873'
                      reason: BP_Harmful
                      throttledCount: '6'
                      url: 'hxxp://unsafe.fstestdomain.com'
                      userName: win10-21h1\tadmin
                    id: 51b83b32-22d9-33f5-bbe0-a803c5bf684a_0
                    device:
                      agentId: 7dc63df2-636c-4939-8e67-dc7c7be09048
                      clientType: computerProtectionPremium
                      id: 0
                      name: win10-21h1
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Webpage ''hxxp://unsafe.fstestdomain.com'' was blocked due to reputation rated harmful'
                    description: Browsing Protection event
  Browsing protection domain name blocked:
    post:
      tags:
        - browsing protection
      summary: Browsing protection blocked a domain
      description: Browsing protection blocked a domain because the domain is disallowed by security administrator.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - browsingProtection
                    description: Engine that triggered security event. Always **browsingProtection** for these events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      categories:
                        type: string
                        description: List of categories associated with the blocked page.
                      alertType:
                        type: string
                        enum:
                          - online_safety.denied_page.block
                          - online_safety.page.block
                        description: Type of an alert.
                      process:
                        type: string
                        description: Process where the blocked page was opened.
                      reason:
                        type: string
                        enum:
                          - WF_Denied
                        description: Type of blocked page.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - process
                      - reason
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                browsing protection denied page:
                  value:
                    severity: warning
                    serverTimestamp: 1677506888211
                    txId: 0000-bd779a8b0fb23d1b
                    persistenceTimestamp: 1677506888507
                    source: ''
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: browsingProtection
                    action: blocked
                    details:
                      alertType: online_safety.denied_page.block
                      clientTimestamp: '1677506887736'
                      hostIpAddress: 10.61.33.187/25
                      process: firefox.exe
                      profileId: '56358066'
                      profileName: test profile
                      profileVersion: '1677506759'
                      reason: WF_Denied
                      throttledCount: '0'
                      userName: win10-21h1\tadmin
                    id: e2c19e28-e246-3f99-a053-7dd2b28504f6_0
                    device:
                      agentId: 5398f1dd-1ce5-4e48-81b8-67ecc63f4232
                      clientType: computerProtectionPremium
                      id: 0
                      name: win10-21h1
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: Webpage was blocked due to domain name being blocked
                    description: Browsing Protection event
  Connection control connection block:
    post:
      tags:
        - connection control
      summary: Connection control blocked a connection
      description: Connection control blocked a connection.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    description: Security event severity rating.
                    enum:
                      - critical
                      - warning
                      - info
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - connectionControl
                    description: Engine that triggered the event. Always **connectionControl** for these events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - connection_control.connection.block
                        description: Connection control alert type.
                      process:
                        type: string
                        description: The process where the page was blocked.
                      direction:
                        type: string
                        enum:
                          - in
                          - out
                        description: The direction of blocked connection.
                      ip:
                        type: string
                        description: IP address to blocked connection.
                      port:
                        type: string
                        description: Port number.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - process
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                connection:
                  value:
                    severity: info
                    serverTimestamp: 1678180637290
                    txId: 0000-080f68642d8c8c84
                    persistenceTimestamp: 1678180637610
                    source: python.exe
                    subscription:
                      id: b53a169f-ccf2-4390-acf4-73ba063f67a8
                    engine: connectionControl
                    action: blocked
                    details:
                      alertType: connection_control.connection.block
                      clientTimestamp: '1678180635978'
                      direction: out
                      hostIpAddress: 10.61.40.89/22
                      ip: 74.125.193.100
                      path: 'C:\latest-system-tests\python\python.exe'
                      port: '443'
                      process: python.exe
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1675782455'
                      throttledCount: '0'
                      userName: win10-21h1\tadmin
                    id: 7fe4b19a-0c40-36f8-9de8-f4a5f9e68d17_0
                    device:
                      agentId: cf390b68-0ab8-44d2-8b8d-616805d765c9
                      clientType: computerProtectionPremium
                      id: 0
                      name: ta_test7973
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: 'Network connection is blocked by Connection control. Blocked process: ''python.exe'''
                    description: Network connection event
  Connection control page block:
    post:
      tags:
        - connection control
      summary: Connection control blocked a page
      description: Connection control blocked a page.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - connectionControl
                    description: Always **connectionControl** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - connection_control.page.block
                        description: Connection control event type.
                      process:
                        type: string
                        description: The process where the page was blocked.
                      path:
                        type: string
                        description: The full path to the process where the page was blocked.
                      url:
                        type: string
                        description: URL of blocked page. This filed presents only if Include the blocked URLs in all security events is enabled.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - process
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                connection:
                  value:
                    severity: info
                    serverTimestamp: 1677002092559
                    txId: 0000-5cd477db191b8a28
                    persistenceTimestamp: 1677002093521
                    source: msedge.exe
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: connectionControl
                    action: blocked
                    details:
                      alertType: connection_control.page.block
                      clientTimestamp: '1676998491984'
                      hostIpAddress: 10.133.36.253/24
                      path: 'C:\program files (x86)\microsoft\edge\application\msedge.exe'
                      process: msedge.exe
                      profileId: '73633559'
                      profileName: test_test
                      profileVersion: '1676991159'
                      throttledCount: '10'
                      userName: WIN10ENT-X64\Administrator
                    id: 0fe52c02-822f-3454-94b1-0682f0b6d385_0
                    device:
                      agentId: 86a890e9-9081-42a3-a23f-26948cfb0de7
                      clientType: computerProtection
                      id: 0
                      name: WIN10ENT-X64
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Network connection is blocked by Connection control. Blocked process: ''msedge.exe'''
                    description: Network connection event
  Security setting changed:
    post:
      tags:
        - setting
      summary: Product security setting has been changed.
      description: Some security setting has been changed.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - setting
                    description: Engine that triggered security event. Always **setting** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      isRemoteChange:
                        type: string
                        enum:
                          - true
                          - false
                        description: Setting has been changed remotely.
                      newValue:
                        type: string
                        description: New value for the setting.
                      oldValue:
                        type: string
                        description: Old value for the setting.
                      restoreTimestamp:
                        type: string
                        description: Restore timestamp.
                      settingName:
                        type: string
                        description: Name of the changed setting.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileName:
                        type: string
                        description: User Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.setting.changed
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                settings changed:
                  value:
                    severity: info
                    serverTimestamp: 1678097805083
                    txId: 0000-0541d2cb5a639418
                    persistenceTimestamp: 1678097806317
                    source: ''
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: setting
                    action: reported
                    details:
                      alertType: product.setting.changed
                      clientTimestamp: '1678097804644'
                      hostIpAddress: 10.61.40.86/22
                      isRemoteChange: 'true'
                      newValue: 'false'
                      oldValue: 'true'
                      profileId: '6938825'
                      profileName: test-sop-own-profile
                      profileVersion: '1618492209'
                      settingName: windows.general_settings.tamper_protection.enabled
                      throttledCount: '0'
                      userName: TA2-WIN7-64\tadmin
                    id: 63160add-3d5c-3779-ae05-8bb05c04ea45_0
                    device:
                      agentId: a5cad540-8f4e-449b-a1d8-182e4094c066
                      clientType: computerProtection
                      id: 0
                      name: TA2-WIN7-64
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: Setting 'windows.general_settings.tamper_protection.enabled' was changed from 'true' to 'false' by TA2-WIN7-64\tadmin
                    description: Setting event
  Path excluded from scanning:
    post:
      tags:
        - setting
      summary: Path has been excluded from scanning.
      description: Certain path was excluded from scanning.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - setting
                    description: Engine that triggered security event. Always **setting** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      path:
                        type: string
                        description: Full path that was excluded.
                      safety:
                        type: string
                        description: Safety.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User's principal name.
                      profileName:
                        type: string
                        description: User Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.path.excluded
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                settings path excluded:
                  value:
                    severity: info
                    serverTimestamp: 1678098078433
                    txId: 0000-62a47c7df900e36e
                    persistenceTimestamp: 1678098079343
                    source: ''
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: setting
                    action: reported
                    details:
                      alertType: product.path.excluded
                      clientTimestamp: '1678098077186'
                      hostIpAddress: 10.61.40.86/22
                      path: 'C:\Program Files (x86)\WithSecure\PSB\diagnostics\fsdiag.exe'
                      profileId: '6938825'
                      profileName: test-sop-own-profile
                      profileVersion: '1618492209'
                      throttledCount: '0'
                      userName: TA2-WIN7-64\tadmin
                    id: 160acd1a-d42a-363d-ad43-f0ddcc3931cd_0
                    device:
                      agentId: a5cad540-8f4e-449b-a1d8-182e4094c066
                      clientType: computerProtection
                      id: 0
                      name: TA2-WIN7-64
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: '''C:\Program Files (x86)\WithSecure\PSB\diagnostics\fsdiag.exe'' was added to the exclusion list'
                    description: Setting event
  URL whitelisted:
    post:
      tags:
        - setting
      summary: URL was whitelisted.
      description: Certain URL was whitelisted and won't be treated with security measures.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - setting
                    description: Engine that triggered security event. Always **setting** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      url:
                        type: string
                        description: URL that was whitelisted.
                      safety:
                        type: string
                        description: Safety rating of the URL.
                      categories:
                        type: string
                        description: List of categories that URL belongs to.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User principal name.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.url.excluded
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                url whitelisted:
                  value:
                    severity: info
                    serverTimestamp: 1678104918928
                    txId: 0000-122550a5de9b9400
                    persistenceTimestamp: 1678104919078
                    source: ''
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: setting
                    action: reported
                    details:
                      alertType: product.url.excluded
                      clientTimestamp: '1678104957292'
                      hostIpAddress: 10.133.64.122/24
                      profileId: '6938825'
                      profileName: test-sop-own-profile
                      profileVersion: '1618492209'
                      safety: known_clean
                      throttledCount: '0'
                      url: adults.fstestdomain.com
                      userName: TA102\Administrator
                    id: 1509f39c-7b10-3b06-9f67-b80787099b44_0
                    device:
                      agentId: 3a45005c-d431-4ee3-a41f-8e0801398716
                      clientType: computerProtectionPremium
                      id: 0
                      name: TA102
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: '''adults.fstestdomain.com'' was added to the allowed sites list'
                    description: Setting event
  Product uninstallation failed:
    post:
      tags:
        - product
      summary: Product uninstallation has failed due to unknown reason.
      description: Product uninstallation has failed due to unknown reason.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - product
                    description: Engine that triggered security event. Always **product** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User principal name.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.uninstallation.failed
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                product uninstallation failed:
                  value:
                    severity: info
                    serverTimestamp: 1763355256884
                    txId: 0000-eba86c89314e44fa
                    persistenceTimestamp: 1763355258327
                    source: ''
                    subscription:
                      id: 64a91a01-6748-4c55-a671-85c7906fc08b
                    engine: product
                    action: reported
                    details:
                      alertType: product.uninstallation.failed
                      clientTimestamp: '1763355254000'
                      hostIpAddress: 10.61.40.100/22
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1628068587'
                      userName: ta_tujrstm7300\tadmin
                    id: 1c9a6cb0-7c0d-3096-b460-f27eda597c68_20
                    device:
                      agentId: b271069a-39b3-436f-8241-267431a00745
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: Xl93rakPTSQ73Pd-1
                      osType: win_wks
                    account:
                      name: bsea-security-events-ta-epp
                      orgPath: 00000000-0000-0000-0000-000000000000/522e9e4f-1c30-45d4-95d0-9b9d3ebf48f7/830e3c69-ae88-416b-8b7a-3695d63901b5/
                      uuid: 830e3c69-ae88-416b-8b7a-3695d63901b5
                    message: Product uninstallation has failed due to unknown reason
                    description: Product notification event
  Product uninstallation not allowed:
    post:
      tags:
        - product
      summary: Product uninstallation is not allowed.
      description: Product uninstallation is not allowed.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - product
                    description: Engine that triggered security event. Always **product** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User principal name.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.uninstallation.not_allowed
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                product uninstallation not allowed:
                  value:
                    severity: info
                    serverTimestamp: 1763355256884
                    txId: 0000-eba86c89314e44fa
                    persistenceTimestamp: 1763355258327
                    source: ''
                    subscription:
                      id: 64a91a01-6748-4c55-a671-85c7906fc08b
                    engine: product
                    action: reported
                    details:
                      alertType: product.uninstallation.not_allowed
                      clientTimestamp: '1763355254000'
                      hostIpAddress: 10.61.40.100/22
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1628068587'
                      userName: ta_tujrstm7300\tadmin
                    id: 1c9a6cb0-7c0d-3096-b460-f27eda597c68_41
                    device:
                      agentId: b271069a-39b3-436f-8241-267431a00745
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: Xl93rakPTSQ73Pd-1
                      osType: win_wks
                    account:
                      name: bsea-security-events-ta-epp
                      orgPath: 00000000-0000-0000-0000-000000000000/522e9e4f-1c30-45d4-95d0-9b9d3ebf48f7/830e3c69-ae88-416b-8b7a-3695d63901b5/
                      uuid: 830e3c69-ae88-416b-8b7a-3695d63901b5
                    message: Product uninstallation is not allowed
                    description: Product notification event
  Product uninstallation invalid password:
    post:
      tags:
        - product
      summary: Product uninstallation has failed due to incorrect uninstallation password.
      description: Product uninstallation has failed due to incorrect uninstallation password.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - product
                    description: Engine that triggered security event. Always **product** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User principal name.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.uninstallation.invalid_password
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                product uninstallation invalid password:
                  value:
                    severity: info
                    serverTimestamp: 1763355256884
                    txId: 0000-eba86c89314e44fa
                    persistenceTimestamp: 1763355258327
                    source: ''
                    subscription:
                      id: 64a91a01-6748-4c55-a671-85c7906fc08b
                    engine: product
                    action: reported
                    details:
                      alertType: product.uninstallation.invalid_password
                      clientTimestamp: '1763355254000'
                      hostIpAddress: 10.61.40.100/22
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1628068587'
                      userName: ta_tujrstm7300\tadmin
                    id: 1c9a6cb0-7c0d-3096-b460-f27eda597c68_48
                    device:
                      agentId: b271069a-39b3-436f-8241-267431a00745
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: Xl93rakPTSQ73Pd-1
                      osType: win_wks
                    account:
                      name: bsea-security-events-ta-epp
                      orgPath: 00000000-0000-0000-0000-000000000000/522e9e4f-1c30-45d4-95d0-9b9d3ebf48f7/830e3c69-ae88-416b-8b7a-3695d63901b5/
                      uuid: 830e3c69-ae88-416b-8b7a-3695d63901b5
                    message: Product uninstallation has failed due to incorrect uninstallation password
                    description: Product notification event
  Product uninstallation cancelled:
    post:
      tags:
        - product
      summary: Product uninstallation has been canceled.
      description: Product uninstallation has been canceled.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - product
                    description: Engine that triggered security event. Always **product** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User principal name.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.uninstallation.cancelled
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                product uninstallation cancelled:
                  value:
                    severity: info
                    serverTimestamp: 1763355256884
                    txId: 0000-eba86c89314e44fa
                    persistenceTimestamp: 1763355258327
                    source: ''
                    subscription:
                      id: 64a91a01-6748-4c55-a671-85c7906fc08b
                    engine: product
                    action: reported
                    details:
                      alertType: product.uninstallation.cancelled
                      clientTimestamp: '1763355254000'
                      hostIpAddress: 10.61.40.100/22
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1628068587'
                      userName: ta_tujrstm7300\tadmin
                    id: 1c9a6cb0-7c0d-3096-b460-f27eda597c68_60
                    device:
                      agentId: b271069a-39b3-436f-8241-267431a00745
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: Xl93rakPTSQ73Pd-1
                      osType: win_wks
                    account:
                      name: bsea-security-events-ta-epp
                      orgPath: 00000000-0000-0000-0000-000000000000/522e9e4f-1c30-45d4-95d0-9b9d3ebf48f7/830e3c69-ae88-416b-8b7a-3695d63901b5/
                      uuid: 830e3c69-ae88-416b-8b7a-3695d63901b5
                    message: Product uninstallation has been canceled
                    description: Product notification event
  Product uninstallation succeeded:
    post:
      tags:
        - product
      summary: Product has been uninstalled successfully.
      description: Product has been uninstalled successfully.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - product
                    description: Engine that triggered security event. Always **product** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      userPrincipalName:
                        type: string
                        description: User principal name.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      alertType:
                        type: string
                        enum:
                          - product.uninstallation.succeeded
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                product uninstallation succeeded:
                  value:
                    severity: info
                    serverTimestamp: 1763355256884
                    txId: 0000-eba86c89314e44fa
                    persistenceTimestamp: 1763355258328
                    source: ''
                    subscription:
                      id: 64a91a01-6748-4c55-a671-85c7906fc08b
                    engine: product
                    action: reported
                    details:
                      alertType: product.uninstallation.succeeded
                      clientTimestamp: '1763355254000'
                      hostIpAddress: 10.61.40.100/22
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1628068587'
                      userName: ta_tujrstm7300\tadmin
                    id: 1c9a6cb0-7c0d-3096-b460-f27eda597c68_64
                    device:
                      agentId: b271069a-39b3-436f-8241-267431a00745
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: Xl93rakPTSQ73Pd-1
                      osType: win_wks
                    account:
                      name: bsea-security-events-ta-epp
                      orgPath: 00000000-0000-0000-0000-000000000000/522e9e4f-1c30-45d4-95d0-9b9d3ebf48f7/830e3c69-ae88-416b-8b7a-3695d63901b5/
                      uuid: 830e3c69-ae88-416b-8b7a-3695d63901b5
                    message: Product has been uninstalled successfully
                    description: Product notification event
  System Events Log:
    post:
      tags:
        - System Events Log
      summary: System Events Log detected a change in security settings on the product.
      description: System Event Log event added.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - systemEventsLog
                    description: Engine that triggered security event. Always **systemEventsLog** for this events.
                  action:
                    type: string
                    enum:
                      - reported
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileName:
                        type: string
                        description: User Name of the Elements Endpoint Protection profile.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      description:
                        type: string
                        description: Description for the event registered.
                      eventXml:
                        type: string
                        description: XML of a system event.
                      systemDataChannel:
                        type: string
                        description: System event channel.
                      systemDataComputer:
                        type: string
                        description: Local ID of the computer.
                      systemDataEventId:
                        type: string
                        description: Internal system's event ID
                      systemDataLevel:
                        type: string
                        description: Severity of system event.
                      systemDataOpcode:
                        type: string
                        description: Operation code for the system event.
                      systemDataProcessId:
                        type: string
                        description: Process ID of a system event.
                      systemDataProviderName:
                        type: string
                        description: System event provider.
                      systemDataRecordId:
                        type: string
                        description: Internal system's record ID.
                      systemDataTask:
                        type: string
                        description: System event task.
                      systemDataTimeCreated:
                        type: string
                        description: System's timestamp of event creation.
                      systemDataUserInfoDomain:
                        type: string
                        description: User domain.
                      systemDataUserInfoSid:
                        type: string
                        description: User info SID.
                      systemDataUserInfoUsername:
                        type: string
                        description: Username from the user info in system record.
                      alertType:
                        type: string
                        enum:
                          - activityMonitor
                        description: Type of alert.
                      throttledCount:
                        type: string
                        description: Number of similar events occurred in the last hour.
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
              examples:
                system events log:
                  value:
                    severity: warning
                    serverTimestamp: 1671616998705
                    txId: 0000-d48ea3e2dc642e2b
                    persistenceTimestamp: 1671616999703
                    source: A member was added to a security-enabled local group
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: systemEventsLog
                    action: reported
                    details:
                      alertType: system_events_log.event.warning.added
                      clientTimestamp: '1671616996867'
                      description: A member was added to a security-enabled local group
                      eventXml: '<Event xmlns=''http://schemas.microsoft.com/win/2004/08/events/event''><System><Provider Name=''Microsoft-Windows-Security-Auditing'' Guid=''{54849625-5478-4994-a5ba-3e3b0328c30d}''/><EventID>4732</EventID><Version>0</Version><Level>0</Level><Task>13826</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime=''2022-12-21T10:03:15.494703000Z''/><EventRecordID>70981</EventRecordID><Correlation ActivityID=''{67df50b8-150b-0001-1351-df670b15d901}''/><Execution ProcessID=''628'' ThreadID=''8620''/><Channel>Security</Channel><Computer>DESKTOP-L37F6GG</Computer><Security/></System><EventData><Data Name=''MemberName''>-</Data><Data Name=''MemberSid''>S-1-5-21-786379189-2148033947-1410340110-1001</Data><Data Name=''TargetUserName''>Users</Data><Data Name=''TargetDomainName''>Builtin</Data><Data Name=''TargetSid''>S-1-5-32-545</Data><Data Name=''SubjectUserSid''>S-1-5-21-786379189-2148033947-1410340110-1000</Data><Data Name=''SubjectUserName''>gtn-admin</Data><Data Name=''SubjectDomainName''>DESKTOP-L37F6GG</Data><Data Name=''SubjectLogonId''>0x1c9cb</Data><Data Name=''PrivilegeList''>-</Data></EventData></Event>'
                      hostIpAddress: 192.168.178.128/24
                      profileId: '901567'
                      profileName: WithSecure™ Office (open)
                      profileVersion: '1648726715'
                      systemDataChannel: Security
                      systemDataComputer: DESKTOP-L37F6GG
                      systemDataEventId: '4732'
                      systemDataLevel: Information
                      systemDataOpcode: Info
                      systemDataProcessId: '628'
                      systemDataProviderName: Microsoft-Windows-Security-Auditing
                      systemDataRecordId: '70981'
                      systemDataTimeCreated: '1671616995'
                      throttledCount: '0'
                      userName: DESKTOP-L37F6GG\gtn-admin
                    id: 262ad2e7-6339-306c-8596-58b4782830a4_0
                    device:
                      agentId: e7c1da66-1e7e-4eb0-8aed-f9bce7c8d91a
                      clientType: computerProtectionPremium
                      id: 19019826
                      name: DESKTOP-L37F6GG
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Event ID: "4732", event source: "Microsoft-Windows-Security-Auditing". Description: "A member was added to a security-enabled local group".'
                    description: System event
  Web content control page block:
    post:
      tags:
        - web content control
      summary: Web content control blocked a page
      description: Web content control blocked a web page because it belongs to a category disallowed by security administrator.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - webContentControl
                    description: Engine that triggered security event. Always **webContentControl** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      process:
                        type: string
                        description: The process where the page was blocked.
                      reason:
                        type: string
                        enum:
                          - WF_Category
                        description: Reason why the page was blocked.
                      categories:
                        type: string
                        description: Comma separated categories of the blocked page.
                      alertType:
                        type: string
                        enum:
                          - online_safety.category_page.block
                        description: Type of an alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - process
                      - reason
                      - categories
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                web content control page blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1677585158077
                    txId: 0000-85c687b587b71e5d
                    persistenceTimestamp: 1677585160426
                    source: ''
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: webContentControl
                    action: blocked
                    details:
                      alertType: online_safety.category_page.block
                      categories: shopping_and_auctions
                      clientTimestamp: '1677585155086'
                      hostIpAddress: 10.61.33.187/25
                      process: firefox.exe
                      profileId: '56358066'
                      profileName: test profile
                      profileVersion: '1677506873'
                      reason: WF_Category
                      throttledCount: '0'
                      userName: win10-21h1\tadmin
                    id: eba87cc3-26bd-3cca-b155-48dbb50889bf_0
                    device:
                      agentId: 7dc63df2-636c-4939-8e67-dc7c7be09048
                      clientType: computerProtectionPremium
                      id: 0
                      name: win10-21h1
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: Web content control blocked webpage due to category 'shopping_and_auctions' being disallowed
                    description: Web Content Control event
  Web traffic scanning content type:
    post:
      tags:
        - web traffic scanning
      summary: Web traffic scanning blocked restricted content type
      description: Web traffic scanning blocked assess to resource with a content restricted by security administrator.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  profileName:
                    type: string
                    description: Name of the Elements Endpoint Protection profile.
                  userName:
                    type: string
                    description: Username that is logged in on a system where event happened.
                  profileId:
                    type: string
                    description: ID of a Elements Endpoint Protection profile.
                  profileVersion:
                    type: string
                    description: Timestamp of last modification of Elements Endpoint Protection profile.
                  name:
                    type: string
                    description: Name of the infected resource.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  websiteUrl:
                    type: string
                    description: URL of the website that triggered the event.
                  computerName:
                    type: string
                    description: Name of the computer.
                  filePath:
                    type: string
                    description: Path to the file that accessed the URL.
                  engine:
                    type: string
                    enum:
                      - webTrafficScanning
                    description: Engine that triggered security event. Always **webTrafficScanning** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - web_traffic_scanning.content_type.block
                        description: Web traffic scanning event type.
                      contentType:
                        type: string
                        description: ContentType of a blocked request.
                      process:
                        type: string
                        description: Executable path that tried to access a blocked resource.
                      url:
                        type: string
                        description: Blocked URL.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - contentType
                      - process
                      - url
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                web traffic scanning content type:
                  value:
                    severity: warning
                    serverTimestamp: 1673364666041
                    txId: 0000-276a0b49c279a426
                    persistenceTimestamp: 1673364668821
                    source: 'hxxp://www.gtn/test_samples/WithSecure_Ultralight_Whitepaper.pdf'
                    subscription:
                      id: 722e473e-3fa2-46e6-a924-7f4efa3eb3e0
                    engine: webTrafficScanning
                    action: blocked
                    message: 'The web page ''hxxp://www.gtn/test_samples/WithSecure_Ultralight_Whitepaper.pdf'' accessed by ''ta_test3607\gtn-admin'' was blocked due to content type restrictions'
                    description: Web Traffic Scanning event
                    details:
                      alertType: web_traffic_scanning.content_type.block
                      clientTimestamp: '1671027297846'
                      contentType: application/pdf
                      hostIpAddress: 192.168.148.131/24
                      name: 'hxxp://www.gtn/test_samples/WithSecure_Ultralight_Whitepaper.pdf'
                      process: 'C:\program files\mozilla firefox\firefox.exe'
                      profileId: '61752513'
                      profileName: 1_aad
                      profileVersion: '1671027266'
                      throttledCount: '3'
                      url: 'hxxp://www.gtn/test_samples/WithSecure_Ultralight_Whitepaper.pdf'
                      userName: ta_test3607\gtn-admin
                    id: d282399d-6e91-33d4-9850-ca519e060552_0
                    device:
                      agentId: 7bb3660a-8a7d-45dc-bcf2-a6f3c03ea62a
                      clientType: computerProtectionPremiumPlusRdr
                      id: 18976314
                      name: ta_test3607
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
  Web traffic scanning url:
    post:
      tags:
        - web traffic scanning
      summary: Web traffic scanning blocked access to a malicious url
      description: Web traffic scanning blocked access to a resource with malicious content.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - webTrafficScanning
                    description: Engine that triggered security event. Always **webTrafficScanning** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      name:
                        type: string
                        description: Name of the infected resource.
                      websiteUrl:
                        type: string
                        description: URL of the website that triggered the event.
                      computerName:
                        type: string
                        description: Name of the computer.
                      filePath:
                        type: string
                        description: Path to the file that accessed the URL.
                      alertType:
                        type: string
                        enum:
                          - web_traffic_scanning.url.block
                        description: Web traffic scanning event type.
                      infectionName:
                        type: string
                        description: Infection name.
                      process:
                        type: string
                        description: Executable path that tried to access an infected resource.
                      url:
                        type: string
                        description: Blocked URL.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - infectionName
                      - process
                      - url
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                web traffic scanning url:
                  value:
                    severity: warning
                    serverTimestamp: 1677143654665
                    txId: 0000-64a888e29fb57abd
                    persistenceTimestamp: 1677143655421
                    source: 'hxxp://fsunrateddomain.gtn/samples/f6.exe'
                    subscription:
                      id: 8ff722e2-b018-4ea7-b398-ad00aa7a09fa
                    engine: webTrafficScanning
                    action: blocked
                    message: 'The malicious web page ''hxxp://fsunrateddomain.gtn/samples/f6.exe'' accessed by ''DESKTOP-16R2JAK\pitkte'' was blocked'
                    description: Web Traffic Scanning event
                    details:
                      alertType: web_traffic_scanning.url.block
                      clientTimestamp: '1677143651478'
                      hostIpAddress: 192.168.145.128/24
                      infectionName: 'Riskware:W32/WithSecure_testfile.A'
                      name: 'hxxp://fsunrateddomain.gtn/samples/f6.exe'
                      process: 'C:\program files (x86)\google\chrome\application\chrome.exe'
                      profileId: '6938825'
                      profileName: test-sop-own-profile
                      profileVersion: '1618492209'
                      throttledCount: '0'
                      url: 'hxxp://fsunrateddomain.gtn/samples/f6.exe'
                      userName: DESKTOP-16R2JAK\pitkte
                    id: 6fe4ac88-3873-3078-a37f-0f2445186b93_0
                    device:
                      agentId: 5c8b0df5-75ff-43b0-ac1d-0e8247d88533
                      clientType: computerProtectionPremium
                      id: 0
                      name: DESKTOP-16R2JAK
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
  Firewall:
    post:
      tags:
        - firewall
      summary: Firewall rule blocked a connection
      description: Firewall rule blocked a connection.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - firewall
                    description: Engine that triggered security event. Always **firewall** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      profileName:
                        type: string
                        description: Name of the Elements Endpoint Protection profile.
                      hostIpAddress:
                        type: string
                        description: Host IP address where security event happened.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      process:
                        type: string
                        description: Name of application that attempted to establish a connection.
                      localAddress:
                        type: string
                        description: Local address.
                      localPort:
                        type: string
                        description: Local port number.
                      remoteAddress:
                        type: string
                        description: Remote IP address.
                      remotePort:
                        type: string
                        description: Remote port number.
                      ruleName:
                        type: string
                        description: Rule name that blocked a connection.
                      ruleGroupName:
                        type: string
                        description: Group name of a rule that blocked a connection.
                      layerName:
                        type: string
                        description: Name of a layer that blocked a connection.
                      ruleDirection:
                        type: string
                        enum:
                          - inbound
                          - outbound
                          - forward
                        description: Direction of triggered rule.
                      ipProtocol:
                        type: string
                        description: IP protocol type.
                      alertType:
                        type: string
                        enum:
                          - firewall.fs_rule_triggered.block
                        description: Type of Firewall alert.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - ipProtocol
                      - localAddress
                      - localPort
                      - process
                      - remoteAddress
                      - remotePort
                      - ruleDirection
                      - ruleName
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                firewall block:
                  value:
                    severity: info
                    serverTimestamp: 1678195021795
                    txId: 0000-281f2fc480f64ce2
                    persistenceTimestamp: 1678195022366
                    source: BlockWgetUserProfile
                    subscription:
                      id: 5c80979b-1795-418b-850b-4a3af9f53def
                    engine: firewall
                    action: blocked
                    details:
                      alertType: firewall.fs_rule_triggered.block
                      clientTimestamp: '1678195020864'
                      hostIpAddress: 10.61.40.132/22
                      ipProtocol: TCP(6)
                      layerName: ALE Connect v4 Layer
                      localAddress: 10.61.40.132
                      localPort: '50021'
                      process: \device\harddiskvolume2\users\tadmin\wget.exe
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1675782455'
                      remoteAddress: 10.133.0.23
                      remotePort: '80'
                      ruleDirection: outbound
                      ruleGroupName: WithSecure Firewall
                      ruleName: BlockWgetUserProfile
                      throttledCount: '0'
                      userName: win10-21h1\tadmin
                    id: afaa691e-79e7-3106-a4bb-0b27ec9b851c_0
                    device:
                      agentId: b8b8b57d-d9d9-4449-8fc4-8277370da283
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: ta_iqamppz3626
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: \device\harddiskvolume2\users\tadmin\wget.exe was blocked from connecting to '10.133.0.23'
                    description: Firewall event
  DeepGuard:
    post:
      tags:
        - deepguard
      summary: DeepGuard blocked an executable file
      description: DeepGuard blocked an executable file.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - deepGuard
                    description: Engine that triggered security event. Always **deepGuard** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      alertType:
                        type: string
                        enum:
                          - ransomware_behavior
                          - file
                        description: DeepGuard alert type.
                      filePath:
                        type: string
                        description: Path to the blocked executable.
                      rarity:
                        type: string
                        enum:
                          - unknown
                          - rare
                          - common
                        description: Rarity of the blocked process.
                      reputation:
                        type: string
                        enum:
                          - unknown
                          - clean
                          - harmful
                          - potentially_unwanted
                        description: Reputation of blocked process based on ORSP query.
                      sha1:
                        type: string
                        description: SHA1 hash of a blocked executable.
                      exploit:
                        type: string
                        description: Full name of an exploit. *\*Applicable only for **deep_guard.exploit.block** alert type*.
                      commandLine:
                        type: string
                        description: Command line of the blocked process.
                      targetPath:
                        type: string
                        description: Path to the target file in file system.
                    required:
                      - clientTimestamp
                      - alertType
                      - filePath
                      - rarity
                      - reputation
                      - sha1
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                deepguard blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1662980091208
                    txId: 0000-88cd1561f3bf0112
                    persistenceTimestamp: 1662980091703
                    source: python.exe
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: deepGuard
                    action: blocked
                    details:
                      alertType: file
                      clientTimestamp: '1662980088000'
                      filePath: 'C:\Users\gtn-admin\miniconda3\envs\change_analyzer\python.exe'
                      hostIpAddress: 192.168.157.141/24
                      name: DeepGuard blocks a rare application
                      profileId: '6938825'
                      profileName: test-sop-own-profile
                      profileVersion: '1618492209'
                      rarity: common
                      reputation: unknown
                      sha1: 88d299350caa965e995fa10e287342d846e4c470
                      size: '95232'
                      userName: ta_test8015\gtn-admin
                    id: 09448f91-8bc4-3a11-8666-a58483932a7a_0
                    device:
                      agentId: 3fef9b44-fb25-4b58-b7d7-eb17ad691523
                      clientType: computerProtection
                      id: 18428086
                      name: ta_test8015
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Rare application was detected in file ''C:\Users\gtn-admin\miniconda3\envs\change_analyzer\python.exe'' and it was blocked'
                    description: DeepGuard event
  Device control access blocked:
    post:
      tags:
        - device control
      summary: Device control blocked access to a device
      description: 'Device control blocked writing data to a device or execution of a program from a device, see alertType property to learn what exact operation was blocked.'
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - deviceControl
                    description: Engine that triggered security event. Always **deviceControl** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      alertType:
                        type: string
                        enum:
                          - device_control.modification.blocked
                          - device_control.execution.blocked
                        description: Type of an operation that was blocked.
                      devicePath:
                        type: string
                        description: Blocked device path.
                      deviceId:
                        type: string
                        description: Blocked device ID.
                      deviceName:
                        type: string
                        description: Blocked device name.
                      initiator:
                        type: string
                        description: Path to the executable that accessed the device.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - devicePath
                      - deviceId
                      - deviceName
                      - initiator
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                device control modification blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1675771263780
                    txId: 0000-6c33fa12c4661d3d
                    persistenceTimestamp: 1675771266321
                    source: PassMark osfdisk SCSI Disk Device
                    subscription:
                      id: d598e458-0077-4c55-a1fa-1680daefeb4b
                    engine: deviceControl
                    action: blocked
                    details:
                      alertType: device_control.modification.blocked
                      clientTimestamp: '1675771257135'
                      deviceId: SCSI\DISK&VEN_PASSMARK&PROD_OSFDISK\1&2AFD7D61&0&000000
                      deviceName: PassMark osfdisk SCSI Disk Device
                      devicePath: '\??\SCSI#Disk&Ven_PassMark&Prod_osfdisk#1&2afd7d61&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}'
                      hostIpAddress: 10.61.40.35/22
                      initiator: 'C:\latest-system-tests\python\python.exe'
                      profileId: '901567'
                      profileName: WithSecure™ Office (open)
                      profileVersion: '1648726715'
                      throttledCount: '0'
                      userName: win10-21h1\tadmin
                    id: 88f4132b-f369-3829-a0d9-0c75260a3b36_0
                    device:
                      agentId: b334cc2c-006e-4c9a-a83f-d4dd39096028
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: ta_dmkakcq2560
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: 'An attempt to modify the file on the following device was blocked: ''PassMark osfdisk SCSI Disk Device'''
                    description: Device Control event
                device control execution blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1675771241437
                    txId: 0000-23655910f5868e4c
                    persistenceTimestamp: 1675771243702
                    source: PassMark osfdisk SCSI Disk Device
                    subscription:
                      id: d598e458-0077-4c55-a1fa-1680daefeb4b
                    engine: deviceControl
                    action: blocked
                    details:
                      alertType: device_control.execution.blocked
                      clientTimestamp: '1675771239083'
                      deviceId: SCSI\DISK&VEN_PASSMARK&PROD_OSFDISK\1&2AFD7D61&0&000000
                      deviceName: PassMark osfdisk SCSI Disk Device
                      devicePath: '\??\SCSI#Disk&Ven_PassMark&Prod_osfdisk#1&2afd7d61&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}'
                      hostIpAddress: 10.61.40.35/22
                      initiator: 'C:\latest-system-tests\python\python.exe'
                      profileId: '901567'
                      profileName: WithSecure™ Office (open)
                      profileVersion: '1648726715'
                      throttledCount: '0'
                      userName: win10-21h1\tadmin
                    id: ecd9f342-080d-3dfe-8775-cacc3a25d3fa_0
                    device:
                      agentId: b334cc2c-006e-4c9a-a83f-d4dd39096028
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: ta_dmkakcq2560
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: 'An attempt to execute files on the following device was blocked: ''PassMark osfdisk SCSI Disk Device'''
                    description: Device Control event
  Device control device blocked:
    post:
      tags:
        - device control
      summary: Device control blocked a device
      description: Device control blocked a device.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - deviceControl
                    description: Engine that triggered security event. Always **deviceControl** for Device control events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      userName:
                        type: string
                        description: Username that is logged in on a system where event happened.
                      alertType:
                        type: string
                        enum:
                          - device_control.device.blocked
                        description: Type of an operation that was blocked.
                      appliedRule:
                        type: string
                        description: Applied rule name.
                      deviceId:
                        type: string
                        description: Blocked device ID.
                      deviceName:
                        type: string
                        description: Blocked device name.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - appliedRule
                      - deviceId
                      - deviceName
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                device control device blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1675771045235
                    txId: 0000-a4ec201ed15fe02e
                    persistenceTimestamp: 1675771047295
                    source: Communications Port (COM1)
                    subscription:
                      id: d598e458-0077-4c55-a1fa-1680daefeb4b
                    engine: deviceControl
                    action: blocked
                    details:
                      alertType: device_control.device.blocked
                      appliedRule: USB Mass Storage Devices
                      clientTimestamp: '1675771044831'
                      deviceId: ACPI\PNP0501\1
                      deviceName: Communications Port (COM1)
                      hostIpAddress: 10.61.40.34/22
                      profileId: '901567'
                      profileName: WithSecure™ Office (open)
                      profileVersion: '1648726715'
                      throttledCount: '0'
                      userName: DESKTOP-U2OPVOC\tadmin
                    id: 2ac48fad-cff9-30fb-8e8b-d7eeed0d6c11_0
                    device:
                      agentId: c042b816-8ef5-48da-b32d-caccb680822f
                      clientType: computerProtectionPremiumPlusRdr
                      id: 0
                      name: ta_oqysjzz8097
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: 'The device ''Communications Port (COM1)'' was blocked based on the following rule: ''USB Mass Storage Devices'''
                    description: Device Control event
  Integrity checker file modified:
    post:
      tags:
        - integrity checker
      summary: Integrity checker detected a file modification attempt
      description: Integrity checker file modified event description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - integrityChecker
                    description: Engine that triggered security event. Always **integrityChecker** value.
                  action:
                    type: string
                    enum:
                      - allow
                      - deny
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - integrity_protection.file_modified
                        description: Integrity checker alert type.
                      path:
                        type: string
                        description: Absolute path to a file that was modified.
                    required:
                      - clientTimestamp
                      - alertType
                      - path
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                integrity checker file modified:
                  value:
                    id: 183dec54-0845-4739-b438-3760ed1aa6f3
                    txId: 0000-0fcdd0f342d04ef8
                    type: ALERT
                    serverTimestamp: 1590690020461
                    device:
                      id: 9430872
                      name: f23c7abd-236f-413b-952a-46fcd36318d2
                      agentId: f23c7abd-236f-413b-952a-46fcd36318d2
                    tenant: '478444'
                    source:
                      content:
                        data:
                          clientDate: 1590690016000
                          alertData:
                            action: allow
                            path: /root/test_env/file.txt
                          alertType: integrity_protection.file_modified
                    message: Tampering with '/root/test_env/file.txt' was allowed
                    description: Integrity Checker event
  Integrity checker process modifying file:
    post:
      tags:
        - integrity checker
      summary: Integrity checker blocked process attempting to modifying a file
      description: Integrity checker process modifying file description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - integrityChecker
                    description: Engine that triggered security event. Always **integrityChecker** value.
                  action:
                    type: string
                    enum:
                      - none
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - integrity_protection.process_modifying_file
                        description: Integrity checker alert type.
                      path:
                        type: string
                        description: Absolute path to a file that was tried to be modified.
                      processId:
                        type: string
                        description: Process ID that made modification attempt.
                      processPath:
                        type: string
                        description: Absolute path to process that made modification attempt.
                    required:
                      - clientTimestamp
                      - alertType
                      - path
                      - processId
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                integrity checker process modifying file:
                  value:
                    id: 683dec54-0845-4739-b438-3760ed1aa6f4_0
                    serverTimestamp: 1589373818926
                    device:
                      id: 9430872
                      name: f23c7abd-236f-413b-952a-46fcd36318d2
                      agentId: f23c7abd-236f-413b-952a-46fcd36318d2
                      clientType: linuxProtection
                    severity: critical
                    engine: integrityChecker
                    source: /root/test_env/modified.txt
                    action: none
                    txId: 0000-0fcdd0f342d04ef8
                    tenant: '478444'
                    details:
                      path: /root/test_env/modified.txt
                      processPath: /usr/bin/bash
                      processId: '80263'
                      clientTimestamp: '1590690016000'
                      alertType: integrity_protection.process_modifying_file
                    message: 'The process with ID: ''80263'' was detected on tampering with ''/root/test_env/modified.txt'''
                    description: Integrity Checker event
  Tamper protection protected process/file/registry:
    post:
      tags:
        - tamper protection
      summary: Tamper protection prevented access to WithSecure™ binaries
      description: Tamper protection protected process/file/registry event description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - tamperProtection
                    description: Engine that triggered security event. Always **tamperProtection** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      actionType:
                        type: string
                        enum:
                          - process
                          - file
                          - registry
                        description: Type of blocked action.
                      alertType:
                        type: string
                        enum:
                          - tamper_protection.process.block
                          - tamper_protection.file.block
                          - tamper_protection.registry.block
                        description: Tamper protection alert type.
                      initiator:
                        type: string
                        description: Path to initiator of action.
                      initiator_certificate_hash:
                        type: string
                        description: Hash of initiator process certificate.
                      initiator_hash:
                        type: string
                        description: Hash of initiator process image.
                      initiator_signer_name:
                        type: string
                        description: Initiator process signer name.
                      ipAddress:
                        type: string
                        description: Current IP address in slash notation .
                      path:
                        type: string
                        description: Path to file or registry key where access was blocked.
                      requestType:
                        type: string
                        enum:
                          - reg_delete_key
                          - reg_delete_value
                          - reg_set_value
                          - reg_rename_key
                          - terminate_process
                          - terminate_thread
                          - set_acl
                          - delete_file
                          - write_file
                          - write_pe
                          - write_to_disk
                          - rename_file
                          - rename_folder
                        description: Blocked operation.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - actionType
                      - alertType
                      - initiator
                      - path
                      - requestType
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                tamper protection blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1677595703094
                    txId: 0000-fc0f5cb682453a70
                    persistenceTimestamp: 1677595703769
                    source: 'C:\Program Files (x86)\WithSecure\PSB\fs_latebound_32.exe'
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: tamperProtection
                    action: blocked
                    details:
                      actionType: process
                      alertType: tamper_protection.process.block
                      clientTimestamp: '1677595702853'
                      hostIpAddress: 10.61.40.115/22
                      initiator: 'C:\Windows\System32\msiexec.exe'
                      initiator_hash: 2c4419c5c6c53eed8d5d19511d8b29992efaaaf4
                      path: 'C:\Program Files (x86)\WithSecure\PSB\fs_latebound_32.exe'
                      profileVersion: '1498867200'
                      requestType: terminate_process
                      throttledCount: '0'
                      userName: System
                    id: 16e1b7fc-e01d-3287-82b8-0f1ba0282936_0
                    device:
                      agentId: 58d076b7-b12b-41f7-b625-25f08c798549
                      clientType: computerProtection
                      id: 0
                      name: TA2-WIN7-64
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: 'Tamper protection protected ''C:\Program Files (x86)\WithSecure\PSB\fs_latebound_32.exe'' from ''C:\Windows\System32\msiexec.exe'''
                    description: Tamper Protection event
  Tamper protection blocked access to service:
    post:
      tags:
        - tamper protection
      summary: Tamper protection prevented access to an WithSecure™ service
      description: Tamper protection blocked access to service event description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - tamperProtection
                    description: Engine that triggered security event. Always **tamperProtection** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      actionType:
                        type: string
                        enum:
                          - service
                        description: Type of blocked action.
                      alertType:
                        type: string
                        enum:
                          - tamper_protection.service.block
                        description: Tamper protection alert type.
                      command:
                        type: string
                        description: Command line that was blocked.
                      initiator_certificate_hash:
                        type: string
                        description: Hash of initiator process certificate.
                      initiator_hash:
                        type: string
                        description: Hash of initiator process image.
                      initiator_signer_name:
                        type: string
                        description: Initiator process signer name.
                      ipAddress:
                        type: string
                        description: Current IP address in slash notation .
                      service:
                        type: string
                        description: Service name that was accessed.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - actionType
                      - alertType
                      - command
                      - service
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                tamper protection service blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1676967032944
                    txId: 0000-363de5271b226000
                    persistenceTimestamp: 1676967033323
                    source: fshoster
                    subscription:
                      id: 4b36dd49-76b7-43e3-a3bb-db42b1abd49e
                    engine: tamperProtection
                    action: blocked
                    details:
                      actionType: service
                      alertType: tamper_protection.service.block
                      clientTimestamp: '1676967031257'
                      command: net  stop fshoster
                      hostIpAddress: 192.168.178.128/24
                      initiator: 'C:\Windows\System32\cmd.exe'
                      initiator_certificate_hash: e866d202865ed3d83c35dff4cde3a2d0fc1d2b17c084e8b26dd0ca28a8c75cfb
                      initiator_hash: a1dbd4949df9e892e52201b06a2d24aa5082b3d5
                      initiator_signer_name: Microsoft Windows
                      profileId: '65354248'
                      profileName: 000_test_profile
                      profileVersion: '1676888297'
                      service: fshoster
                      throttledCount: '0'
                      userName: DESKTOP-L37F6GG\gtn-admin
                    id: a945b4d9-45ec-336a-b36d-f53a4e84a67c_0
                    device:
                      agentId: 7c049487-0bb7-45cc-b0e0-0e01c92982a5
                      clientType: computerProtection
                      id: 0
                      name: DESKTOP-L37F6GG
                    account:
                      name: test
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2/
                      uuid: 0c75c79d-88af-4bfd-9c00-e1f87ce7a5f2
                    tenant: '478444'
                    message: Service 'fshoster' was blocked from stop
                    description: Tamper Protection event
  Tamper protection blocked uninstallation:
    post:
      tags:
        - tamper protection
      summary: Tamper protection prevented an uninstallation attempt
      description: Tamper protection blocked uninstallation event description
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - tamperProtection
                    description: Engine that triggered security event. Always **tamperProtection** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      alertType:
                        type: string
                        enum:
                          - tamper_protection.uninstall.block
                        description: Tamper protection alert type.
                      command:
                        type: string
                        description: Command line used for uninstallation.
                      initiator:
                        type: string
                        description: Path to initiator of action.
                      initiator_certificate_hash:
                        type: string
                        description: Hash of initiator process certificate.
                      initiator_hash:
                        type: string
                        description: Hash of initiator process image.
                      initiator_signer_name:
                        type: string
                        description: Initiator process signer name.
                      throttledCount:
                        type: string
                        description: Number of similar events happened within an hour.
                    required:
                      - clientTimestamp
                      - alertType
                      - command
                      - initiator
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                tamper protection uninstall blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1678188804526
                    txId: 0000-44f40a296b4bd837
                    persistenceTimestamp: 1678188806652
                    source: 'C:\latest-system-tests\python\python.exe'
                    subscription:
                      id: d3ed04dc-6866-4d56-acac-8accd5cd3e18
                    engine: tamperProtection
                    action: blocked
                    details:
                      actionType: uninstall
                      alertType: tamper_protection.uninstall.block
                      clientTimestamp: '1678188803105'
                      command: 'C:\latest-system-tests\testables\ws_uninstallation_tool32.exe --products oneclient --silent'
                      hostIpAddress: 10.61.40.66/22
                      initiator: 'C:\latest-system-tests\python\python.exe'
                      initiator_certificate_hash: d67c945211a51e0836accd46f4be4a14a0daea3df5f69227ebd3f62682109ef7
                      initiator_hash: 6cf8830575acbefb83c361a6b719bdd15f0b1245
                      initiator_signer_name: WithSecure Corporation
                      profileId: '910739'
                      profileName: TA_TEST_2
                      profileVersion: '1675782455'
                      throttledCount: '0'
                      userName: TA2-WIN81-64\tadmin
                    id: 63ad5654-d9c5-3a9a-8291-21f87b0bf255_0
                    device:
                      agentId: e6ce57a2-bb96-40a4-bb19-8e7d0156f48d
                      clientType: computerProtection
                      id: 0
                      name: ta_wwibvwv8814
                    account:
                      name: ta-ccf-psb-company
                      orgPath: 00000000-0000-0000-0000-000000000000/e2675985-4c4d-4467-ac60-87f075075b92/6b76acd1-95d5-45c9-aa70-1b4e3c27931c/
                      uuid: 6b76acd1-95d5-45c9-aa70-1b4e3c27931c
                    tenant: '478444'
                    message: 'C:\latest-system-tests\python\python.exe was blocked from uninstalling the product'
                    description: Tamper Protection event
  XFence:
    post:
      tags:
        - XFence
      summary: XFence security event
      description: XFence Mac security event.
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - xFence
                    description: Engine that triggered security event. Always **xFence** for this events.
                  action:
                    type: string
                    enum:
                      - blocked
                    description: Action that was taken.
                  details:
                    type: object
                    properties:
                      profileId:
                        type: string
                        description: ID of a Elements Endpoint Protection profile.
                      profileVersion:
                        type: string
                        description: Timestamp of last modification of Elements Endpoint Protection profile.
                      clientTimestamp:
                        type: string
                        description: Timestamp of a security event from the client machine.
                      operation:
                        type: string
                        enum:
                          - unknown
                          - read
                          - write
                          - create
                          - execute
                          - mount
                        description: Operation that was performed.
                      targetPath:
                        type: string
                        description: Path to the target file in file system.
                      processPath:
                        type: string
                        description: Path to the process.
                      processHash:
                        type: string
                        description: Process hash.
                      processTeamId:
                        type: string
                        description: Process team ID.
                      parentPath:
                        type: string
                        description: Path to the parent process.
                      alertType:
                        type: string
                        enum:
                          - xfence.blocked
                        description: xFence alert type.
                    required:
                      - clientTimestamp
                      - alertType
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - action
                  - details
                  - organization
                  - device
              examples:
                xfence blocked:
                  value:
                    severity: warning
                    serverTimestamp: 1678274515288
                    txId: 0000-fbf337e54c354f6c
                    persistenceTimestamp: 1678274515575
                    source: testApp
                    subscription:
                      id: aee8d4da-9893-40df-82af-da9ff265865c
                    engine: xFence
                    action: blocked
                    details:
                      alertType: xfence.blocked
                      clientTimestamp: '1678274513541'
                      operation: write
                      parentPath: /bin/zsh
                      processHash: e898f55961984396bcc4db4833c8758f7f03d9d9f65b3e9fdee644a7ffc97326
                      processPath: /Users/test/Desktop/testApp
                      processTeamId: J4VD7X35V5
                      profileId: '118181'
                      profileName: WithSecure™ Office for Mac (open)
                      profileVersion: '1649230230'
                      targetPath: /Users/test/Desktop/testfile
                    id: c952373c-c143-37b1-3223-c5668e015775_0
                    device:
                      agentId: fd05d8b8-113a-4733-b493-82907749f50f
                      clientType: computerProtection
                      id: 0
                      name: ip-192-168-64-103
                    account:
                      name: Epics Company
                      orgPath: 00000000-0000-0000-0000-000000000000/ca2700a3-8303-4292-9a72-28f2dc555f7b/b9ac6b25-8b79-4a54-a368-36103571c5b3/
                      uuid: b9ac6b25-8b79-4a54-a368-36103571c5b3
                    tenant: '668'
                    message: XFENCE blocked write access to '/Users/test/Desktop/testfile'
                    description: XFENCE event
  Collaboration protection email breach:
    post:
      tags:
        - collaboration protection
      summary: Collaboration Protection Email Breach
      description: Collaboration Protection Email Breach
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - collaborationProtectionEmailBreach
                    description: Engine that triggered security event. Always **collaborationProtectionEmailBreach** for this events.
                  action:
                    type: string
                    enum:
                      - updated
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      eventId:
                        type: string
                        description: Event ID
                      userPrincipalName:
                        type: string
                        description: User principal name
                      serviceType:
                        type: string
                        enum:
                          - o365-teams
                          - o365-sharepoint
                          - o365-onedrive
                          - o365-exchange
                        description: Service type
                      serviceId:
                        type: string
                        description: Service ID
                      severity:
                        type: string
                        description: Event severity
                      category:
                        type: string
                        description: Event category
                      created:
                        type: string
                        description: Timestamp of when the event was created
                      itemType:
                        type: string
                        enum:
                          - SharePointDocumentLibraryItem
                          - OneDriveUserDriveItem
                          - TeamsChannelItem
                          - MeetingMessage
                          - EmailMessage
                          - Appointment
                          - Task
                          - Contact
                          - ContactGroup
                          - Persona
                          - PostItem
                          - Unknown
                          - TeamsMessage
                          - InboxRule
                          - BreachedDomain
                        description: Type of the item
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                email breach:
                  value:
                    id: afe9fa3a-e42d-3e02-bbf0-9d274dcdeb13
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    account:
                      uuid: 5fc822d3-486e-4c9e-b24d-a472358c9609
                      name: Test Company
                      orgPath: 00000000-0000-0000-0000-000000000000/5fc822d3-486e-4c9e-b24d-a472358c9609/5fc822d3-486e-4c9e-b24d-a472358c9609/
                    severity: critical
                    engine: collaborationProtectionEmailBreach
                    source: ''
                    action: reportedToAdminAndUser
                    txId: 0000-0cf511d8c7194ec4-afe9fa3a-e42d-3e02-bbf0-9d274dcdeb13
                    details:
                      eventId: 80ae4c73-b59f-4ebc-a09f-bcf4a598d1e1
                      userPrincipalName: 3003@e365monika.onmicrosoft.com
                      serviceType: o365-exchange
                      serviceId: 95765aea-a9d0-4a25-a591-0a7193fb14ed
                      severity: critical
                      category: breachedDomainAccount
                      created: '1687508482000'
                      itemType: breachedDomain
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: 3003@e365monika.onmicrosoft.com
                      name: 3003@e365monika.onmicrosoft.com
                    fingerprint:
                      similarity: CWCg16SLmoNSi9CL
                    message: 'A breach was detected for ''3003@e365monika.onmicrosoft.com''. Action taken: ''reportedToAdminAndUser''.'
                    description: Email breach event
  Collaboration protection inbox rule scan:
    post:
      tags:
        - collaboration protection
      summary: Collaboration Protection Email inbox rule scan
      description: Collaboration Protection Email inbox rule scan
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - collaborationProtectionInboxRuleScan
                    description: Engine that triggered security event. Always **collaborationProtectionInboxRuleScan** for this events.
                  action:
                    type: string
                    enum:
                      - updated
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      eventId:
                        type: string
                        description: Event ID
                      userPrincipalName:
                        type: string
                        description: User principal name
                      serviceType:
                        type: string
                        enum:
                          - o365-teams
                          - o365-sharepoint
                          - o365-onedrive
                          - o365-exchange
                        description: Service type
                      serviceId:
                        type: string
                        description: Service ID
                      severity:
                        type: string
                        description: Event severity
                      category:
                        type: string
                        description: Event category
                      created:
                        type: string
                        description: Timestamp of when the event was created
                      inboxRuleName:
                        type: string
                        description: Rule name for inbox
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                EMail inbox rule scan:
                  value:
                    id: 6ac84f90-6e3e-335b-9a07-82b3cc16f91b_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    account:
                      uuid: 5fc822d3-486e-4c9e-b24d-a472358c9609
                      name: Test Company
                      orgPath: 00000000-0000-0000-0000-000000000000/5fc822d3-486e-4c9e-b24d-a472358c9609/5fc822d3-486e-4c9e-b24d-a472358c9609/
                    severity: warning
                    engine: collaborationProtectionInboxRuleScan
                    source: ''
                    action: none
                    txId: 0000-440695fc922a4e20-0000-0000434322221216
                    details:
                      eventId: a16594a1-becc-479e-b4d9-f2da106109b6
                      userPrincipalName: user@quarytest.onmicrosoft.com
                      serviceType: o365-exchange
                      serviceId: c22619da-60df-4f09-8a18-28aeec93e19b
                      severity: medium
                      category: suspiciousInboxRule
                      created: '1686835111000'
                      inboxRuleName: main rule name
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: user@quarytest.onmicrosoft.com
                      name: user@quarytest.onmicrosoft.com
                    fingerprint:
                      similarity: lSlA5pezFbXf0cJq
                    message: A suspicious inbox rule 'main rule name' was detected for 'user@quarytest.onmicrosoft.com'.
                    description: Suspicious inbox rule event
  Collaboration protection email scan:
    post:
      tags:
        - collaboration protection
      summary: Collaboration Protection Email Scan
      description: Collaboration Protection Email Scan
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - collaborationProtectionEmailScan
                    description: Engine that triggered security event. Always **collaborationProtectionEmailScan** for this events.
                  action:
                    type: string
                    enum:
                      - updated
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      eventId:
                        type: string
                        description: Event ID
                      userPrincipalName:
                        type: string
                        description: User principal name
                      serviceType:
                        type: string
                        enum:
                          - o365-teams
                          - o365-sharepoint
                          - o365-onedrive
                          - o365-exchange
                        description: Service type
                      serviceId:
                        type: string
                        description: Service ID
                      severity:
                        type: string
                        description: Event severity
                      category:
                        type: string
                        description: Event category
                      created:
                        type: string
                        description: Timestamp of when the event was created
                      itemType:
                        type: string
                        enum:
                          - SharePointDocumentLibraryItem
                          - OneDriveUserDriveItem
                          - TeamsChannelItem
                          - MeetingMessage
                          - EmailMessage
                          - Appointment
                          - Task
                          - Contact
                          - ContactGroup
                          - Persona
                          - PostItem
                          - Unknown
                          - TeamsMessage
                          - InboxRule
                          - BreachedDomain
                        description: Type of the item
                      itemSender:
                        type: string
                        description: Email of sender
                      sendingServerIP:
                        type: string
                        description: IP of sending server
                      itemParentFolderName:
                        type: string
                        description: Email parent folder name
                      itemSize:
                        type: string
                        description: Item size
                      itemSubject:
                        type: string
                        description: Email subject
                      internetMessageId:
                        type: string
                        description: Internet message ID
                      unsafeUrlCount:
                        type: string
                        description: Number of unsafe urls
                      unsafeAttachmentCount:
                        type: string
                        description: Number of unsafe attachments
                      itemDateTimeReceived:
                        type: string
                        description: Timestamp when email was received
                      attachments:
                        type: string
                        description: List of attachments
                      urls:
                        type: string
                        description: List of harmful urls
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                email scan:
                  value:
                    id: cf81f722-6d92-3965-8cd7-89da1dc3c91d_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    account:
                      uuid: 51cebe8d-f671-4d50-b4fd-7f701cea1dc3
                      name: Test Company
                      orgPath: 00000000-0000-0000-0000-000000000000/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/51cebe8d-f671-4d50-b4fd-7f701cea1dc3/
                    severity: warning
                    engine: collaborationProtectionEmailScan
                    source: ''
                    action: noneBecauseMissing
                    txId: 0000-a7b175cb49074a86-0000-24347384954574830
                    details:
                      eventId: 82d7000d-c6ce-42db-823e-a14bf0d9f5af
                      userPrincipalName: hietpo@6kc3b2.onmicrosoft.com
                      serviceType: o365-exchange
                      serviceId: 11111111-1111-1111-1111-111111111111
                      severity: medium
                      category: harmfulContent
                      created: '1683888672000'
                      itemSender: AdeleV@6kc3b2.onmicrosoft.com
                      sendingServerIP: 'fe80::459d:de80:c84:df2e'
                      itemParentFolderName: Inbox
                      itemSize: '36647'
                      itemSubject: Test111
                      internetMessageId: <AM5PR03MB30590FDF840881C2FC831988AC759@AM5PR03MB3059.eurprd03.prod.outlook.com>
                      itemType: EmailMessage
                      unsafeUrlCount: '1'
                      unsafeAttachmentCount: '2'
                      itemDateTimeReceived: '1683888661000'
                      attachments: '[{"sha1":"f698eb70e11a36e0ffa6525d386cc127815247fd","prevalence":"common","filename":"bad_boy.scan","size":"251","prevalenceScore":"60","verdict":"Unsafe","reputation":"unknown","reputationScore":"150","detonation":"false"},{"sha1":"0912b6e31ec6f676af5bab5f1e95b3ab8cb13660","prevalence":"unique","filename":"good_boy-unique-1.ok","size":"1048836","prevalenceScore":"1","verdict":"Safe","reputation":"unknown","reputationScore":"150","detonation":"false"}]'
                      urls: '[{"sha1":"ebe616225523aa82c5398a543a56761dd74bd3ff","verdict":"HarmfulUrl","reputation":"unsafe_url","reputationScore":"-80","url":"unsafe.fstestdomain.com"}]'
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: hietpo@6kc3b2.onmicrosoft.com
                      name: hietpo@6kc3b2.onmicrosoft.com
                    fingerprint:
                      similarity: g10F9A4ycYu9z9FP
                    message: '''harmfulContent'' was detected in an email sent to ''hietpo@6kc3b2.onmicrosoft.com'', subject ''Test111'', in ''Inbox''. Action taken: ''noneBecauseMissing'''
                    description: Email scanning event
  Collaboration protection attachments scan:
    post:
      tags:
        - collaboration protection
      summary: Collaboration Protection scan
      description: Collaboration Protection scan
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: integer
                    description: Timestamp of a security event from the server.
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - collaborationProtectionOneDriveScan
                      - collaborationProtectionSharepointScan
                      - collaborationProtectionTeamsScan
                    description: Engine that triggered security event.
                  action:
                    type: string
                    enum:
                      - updated
                    description: Action performed in response to an incident.
                  details:
                    type: object
                    properties:
                      eventId:
                        type: string
                        description: Event ID
                      userPrincipalName:
                        type: string
                        description: User principal name
                      serviceType:
                        type: string
                        enum:
                          - o365-teams
                          - o365-sharepoint
                          - o365-onedrive
                          - o365-exchange
                        description: Service type
                      serviceId:
                        type: string
                        description: Service ID
                      severity:
                        type: string
                        description: Event severity
                      category:
                        type: string
                        description: Event category
                      created:
                        type: string
                        description: Timestamp of when the event was created
                      quarantineId:
                        type: string
                        description: Quarantine ID
                      itemType:
                        type: string
                        enum:
                          - SharePointDocumentLibraryItem
                          - OneDriveUserDriveItem
                          - TeamsChannelItem
                          - MeetingMessage
                          - EmailMessage
                          - Appointment
                          - Task
                          - Contact
                          - ContactGroup
                          - Persona
                          - PostItem
                          - Unknown
                          - TeamsMessage
                          - InboxRule
                          - BreachedDomain
                        description: Item type
                      location:
                        type: string
                        description: Location of the object
                      sha1:
                        type: string
                        description: SHA1 checksum of the object
                      prevalence:
                        type: string
                        description: Prevalence
                      filename:
                        type: string
                        description: Filename of the object
                      size:
                        type: string
                        description: File size
                      prevalenceScore:
                        type: string
                        description: Prevalence score
                      verdict:
                        type: string
                        description: Verdict
                      reputation:
                        type: string
                        description: File reputation
                      reputationScore:
                        type: string
                        description: Reputation score
                      detonation:
                        type: string
                        description: ''
                  organization:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Organization ID.
                      name:
                        type: string
                        description: Organization name.
                    required:
                      - id
                      - name
                  device:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Device ID.
                      name:
                        type: string
                        description: Device name.
                      winsName:
                        type: string
                        description: Device WINS name.
                      clientType:
                        type: string
                        description: Client type.
                    required:
                      - id
                      - name
                      - winsName
                      - clientType
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - details
                  - organization
                  - device
              examples:
                OneDrive scan:
                  value:
                    id: a6c33370-885b-3e42-944b-bb2223ec8110_0
                    serverTimestamp: 1589373818926
                    persistenceTimestamp: 1589373818926
                    account:
                      uuid: 5fc822d3-486e-4c9e-b24d-a472358c9609
                      name: Test Company
                      orgPath: 00000000-0000-0000-0000-000000000000/5fc822d3-486e-4c9e-b24d-a472358c9609/5fc822d3-486e-4c9e-b24d-a472358c9609/
                    severity: warning
                    engine: collaborationProtectionOneDriveScan
                    source: ''
                    action: quarantined
                    txId: 0000-3f220f138be5494b-0000-k2h5zf5mf80u7oii
                    details:
                      eventId: 8d817c4b-3795-4b77-814f-4c88ff4ef6e9
                      userPrincipalName: admin@Cpo365test07f.onmicrosoft.com
                      serviceType: o365-onedrive
                      serviceId: 4e7dea6b-6ce5-41fc-b3f0-7013c4e51cb2
                      severity: medium
                      category: harmfulContent
                      created: '1687772169000'
                      quarantineId: dac4c590-621f-453d-ab31-553699cf98dd
                      itemType: OneDriveUserDriveItem
                      location: 'https://cpo365test07f-my.sharepoint.com/personal/admin_cpo365test07f_onmicrosoft_com/Documents/8R9CDOQQSZ'
                      sha1: f698eb70e11a36e0ffa6525d386cc127815247fd
                      prevalence: common
                      filename: 8R9CDOQQSZ
                      size: '43'
                      prevalenceScore: '60'
                      verdict: Unsafe
                      reputation: unknown
                      reputationScore: '150'
                      detonation: 'false'
                    reporting:
                      timestamp: 1589373818926
                    target:
                      id: admin@Cpo365test07f.onmicrosoft.com
                      name: admin@Cpo365test07f.onmicrosoft.com
                    fingerprint:
                      similarity: 4o6zUqHuOT
                    message: 'A OneDrive file ''8R9CDOQQSZ'' was detected as ''harmfulContent''. Action taken: ''quarantined'''
                    description: Microsoft OneDrive scanning event
  Opened recommendation:
    post:
      tags:
        - exposure management
      summary: XM recommendation was opened
      description: Exposure management recommendation was opened
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: string
                    format: date-time
                    description: 'Date and time of event being received by backend server. UTC+00:00.'
                  persistenceTimestamp:
                    type: string
                    format: date-time
                    description: 'Date and time when the event''s processing finished and it was written to the database. UTC+00:00.'
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - xmRecommendation
                    description: Engine that triggered the security event. Always **xmRecommendation** for this event.
                  xmRecommendationKey:
                    type: string
                    description: 'Key for the kind of XM recommendation. For example **xmRecommendationAutomatic**, **xmRecommendationEntraIdOldPassword**.'
                  action:
                    type: string
                    description: Action performed in response to an incident.
                  acknowledged:
                    type: boolean
                    description: Indicates if the recommendation was acknowledged.
                  details:
                    type: object
                    properties:
                      alertType:
                        type: string
                        description: Type of alert.
                      recommendationDetails:
                        type: string
                        description: Details of the recommendation.
                      recommendationId:
                        type: string
                        description: Unique ID of the recommendation.
                      recommendationName:
                        type: string
                        description: Name of the recommendation.
                      recommendationStatus:
                        type: string
                        enum:
                          - open
                          - closed
                          - acceptedRisk
                        description: Status of the recommendation. Always **open** for this event.
                      remediationEffort:
                        type: string
                        description: Estimated effort to remediate.
                      remediationEffortString:
                        type: string
                        description: Effort level as a string.
                      remediationImpact:
                        type: string
                        enum:
                          - critical
                          - high
                          - medium
                          - low
                        description: Impact of remediation.
                      topAssets:
                        type: array
                        description: List of top assets affected by the recommendation.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Asset ID.
                            assetType:
                              type: string
                              description: Type of asset.
                            name:
                              type: string
                              description: Asset name.
                            exposureRisk:
                              type: integer
                              description: Exposure risk score of the asset.
                            importance:
                              type: string
                              enum:
                                - critical
                                - high
                                - medium
                                - low
                              description: Importance of the asset.
                            businessContext:
                              type: string
                              description: Business context of the asset.
                      totalAssets:
                        type: integer
                        description: Total number of assets affected.
                      topFindings:
                        type: array
                        description: List of top findings related to the recommendation.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Finding ID.
                            name:
                              type: string
                              description: Finding name.
                      totalFindings:
                        type: integer
                        description: Total number of findings.
                  organization:
                    type: object
                    properties:
                      name:
                        type: string
                        description: Organization name.
                      id:
                        type: string
                        description: Organization ID.
                  target:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Target ID.
                      name:
                        type: string
                        description: Target name.
                  eventTransactionId:
                    type: string
                    description: Unique ID of the event transaction.
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - organization
                  - details
                  - target
              examples:
                Automatically created recommendation:
                  value:
                    id: 68f0017f-1286-414c-b65e-516271164564_0
                    severity: critical
                    engine: xmRecommendation
                    xmRecommendationKey: xmRecommendationAutomatic
                    action: none
                    acknowledged: false
                    details:
                      alertType: exposure.recommendation
                      recommendationDetails: Recommendation details
                      recommendationId: 84861497-de31-4528-aa91-ba4baee668dd
                      recommendationName: automatic beta
                      recommendationStatus: open
                      remediationEffort: '8'
                      remediationEffortString: High
                      remediationImpact: low
                      topAssets:
                        - id: 68f0017f-1286-414c-b65e-516271164564
                          assetType: host
                          name: host1
                          exposureRisk: 1
                          importance: high
                          businessContext: business context
                      totalAssets: 1
                      topFindings:
                        - id: 99a60a8b-48e9-4d24-8dd0-ea3d522ebba2
                          name: Finding 1
                      totalFindings: 1
                    organization:
                      name: CI-Test-Company-1
                      id: dc62ac4e-dbec-4901-a511-a1d6dfaddbc2
                    target:
                      id: dc62ac4e-dbec-4901-a511-a1d6dfaddbc2
                      name: CI-Test-Company-1
                    eventTransactionId: transaction-id
                    persistenceTimestamp: '2025-04-28T11:32:20.262Z'
                    serverTimestamp: '2025-04-28T11:32:19.440Z'
                    message: 'XM recommendation was opened. Recommendation type: ''automatic beta'''
                    description: Exposure management recommendation event
  Closed recommendation:
    post:
      tags:
        - exposure management
      summary: XM recommendation was closed
      description: Exposure management recommendation was closed
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: string
                    format: date-time
                    description: 'Date and time of event being received by backend server. UTC+00:00.'
                  persistenceTimestamp:
                    type: string
                    format: date-time
                    description: 'Date and time when the event''s processing finished and it was written to the database. UTC+00:00.'
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - xmRecommendation
                    description: Engine that triggered the security event. Always **xmRecommendation** for this event.
                  xmRecommendationKey:
                    type: string
                    description: 'Key for the kind of XM recommendation. For example **xmRecommendationAutomatic**, **xmRecommendationEntraIdOldPassword**.'
                  action:
                    type: string
                    description: Action performed in response to an incident.
                  acknowledged:
                    type: boolean
                    description: Indicates if the recommendation was acknowledged.
                  details:
                    type: object
                    properties:
                      alertType:
                        type: string
                        description: Type of alert.
                      recommendationDetails:
                        type: string
                        description: Details of the recommendation.
                      recommendationId:
                        type: string
                        description: Unique ID of the recommendation.
                      recommendationName:
                        type: string
                        description: Name of the recommendation.
                      recommendationStatus:
                        type: string
                        enum:
                          - open
                          - closed
                          - acceptedRisk
                        description: Status of the recommendation. Always **closed** for this event.
                      remediationEffort:
                        type: string
                        description: Estimated effort to remediate.
                      remediationEffortString:
                        type: string
                        description: Effort level as a string.
                      remediationImpact:
                        type: string
                        enum:
                          - critical
                          - high
                          - medium
                          - low
                        description: Impact of remediation.
                      topAssets:
                        type: array
                        description: List of top assets affected by the recommendation.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Asset ID.
                            assetType:
                              type: string
                              description: Type of asset.
                            name:
                              type: string
                              description: Asset name.
                            exposureRisk:
                              type: integer
                              description: Exposure risk score of the asset.
                            importance:
                              type: string
                              enum:
                                - critical
                                - high
                                - medium
                                - low
                              description: Importance of the asset.
                            businessContext:
                              type: string
                              description: Business context of the asset.
                      totalAssets:
                        type: integer
                        description: Total number of assets affected.
                      topFindings:
                        type: array
                        description: List of top findings related to the recommendation.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Finding ID.
                            name:
                              type: string
                              description: Finding name.
                      totalFindings:
                        type: integer
                        description: Total number of findings.
                  organization:
                    type: object
                    properties:
                      name:
                        type: string
                        description: Organization name.
                      id:
                        type: string
                        description: Organization ID.
                  target:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Target ID.
                      name:
                        type: string
                        description: Target name.
                  eventTransactionId:
                    type: string
                    description: Unique ID of the event transaction.
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - organization
                  - details
                  - target
              examples:
                Automatically created recommendation:
                  value:
                    id: 68f0017f-1286-414c-b65e-516271164564_0
                    severity: critical
                    engine: xmRecommendation
                    xmRecommendationKey: xmRecommendationAutomatic
                    action: none
                    acknowledged: false
                    details:
                      alertType: exposure.recommendation
                      recommendationDetails: Recommendation details
                      recommendationId: 84861497-de31-4528-aa91-ba4baee668dd
                      recommendationName: automatic beta
                      recommendationStatus: closed
                      remediationEffort: '8'
                      remediationEffortString: High
                      remediationImpact: low
                      topAssets:
                        - id: 68f0017f-1286-414c-b65e-516271164564
                          assetType: host
                          name: host1
                          exposureRisk: 1
                          importance: high
                          businessContext: business context
                      totalAssets: 1
                      topFindings:
                        - id: 99a60a8b-48e9-4d24-8dd0-ea3d522ebba2
                          name: Finding 1
                      totalFindings: 1
                    organization:
                      name: CI-Test-Company-1
                      id: dc62ac4e-dbec-4901-a511-a1d6dfaddbc2
                    target:
                      id: dc62ac4e-dbec-4901-a511-a1d6dfaddbc2
                      name: CI-Test-Company-1
                    eventTransactionId: transaction-id
                    persistenceTimestamp: '2025-04-28T11:32:20.262Z'
                    serverTimestamp: '2025-04-28T11:32:19.440Z'
                    message: 'XM recommendation was closed. Recommendation type: ''automatic beta'''
                    description: Exposure management recommendation event
  Recommendation risk accepted:
    post:
      tags:
        - exposure management
      summary: Risk was accepted for XM recommendation
      description: Risk was accepted for exposure management recommendation
      responses:
        Security event:
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Security event ID.
                  severity:
                    type: string
                    enum:
                      - critical
                      - warning
                      - info
                    description: Security event severity.
                  serverTimestamp:
                    type: string
                    format: date-time
                    description: 'Date and time of event being received by backend server. UTC+00:00.'
                  persistenceTimestamp:
                    type: string
                    format: date-time
                    description: 'Date and time when the event''s processing finished and it was written to the database. UTC+00:00.'
                  message:
                    type: string
                    description: |
                      Human-readable text that describes this concrete event.
                  description:
                    type: string
                    description: |
                      Human-readable text that describes the event type.
                  engine:
                    type: string
                    enum:
                      - xmRecommendation
                    description: Engine that triggered the security event. Always **xmRecommendation** for this event.
                  xmRecommendationKey:
                    type: string
                    description: 'Key for the kind of XM recommendation. For example **xmRecommendationAutomatic**, **xmRecommendationEntraIdOldPassword**.'
                  action:
                    type: string
                    description: Action performed in response to an incident.
                  acknowledged:
                    type: boolean
                    description: Indicates if the recommendation was acknowledged.
                  details:
                    type: object
                    properties:
                      alertType:
                        type: string
                        description: Type of alert.
                      recommendationDetails:
                        type: string
                        description: Details of the recommendation.
                      recommendationId:
                        type: string
                        description: Unique ID of the recommendation.
                      recommendationName:
                        type: string
                        description: Name of the recommendation.
                      recommendationStatus:
                        type: string
                        enum:
                          - open
                          - closed
                          - acceptedRisk
                        description: Status of the recommendation. Always **acceptedRisk** for this event.
                      remediationEffort:
                        type: string
                        description: Estimated effort to remediate.
                      remediationEffortString:
                        type: string
                        description: Effort level as a string.
                      remediationImpact:
                        type: string
                        enum:
                          - critical
                          - high
                          - medium
                          - low
                        description: Impact of remediation.
                      topAssets:
                        type: array
                        description: List of top assets affected by the recommendation.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Asset ID.
                            assetType:
                              type: string
                              description: Type of asset.
                            name:
                              type: string
                              description: Asset name.
                            exposureRisk:
                              type: integer
                              description: Exposure risk score of the asset.
                            importance:
                              type: string
                              enum:
                                - critical
                                - high
                                - medium
                                - low
                              description: Importance of the asset.
                            businessContext:
                              type: string
                              description: Business context of the asset.
                      totalAssets:
                        type: integer
                        description: Total number of assets affected.
                      topFindings:
                        type: array
                        description: List of top findings related to the recommendation.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Finding ID.
                            name:
                              type: string
                              description: Finding name.
                      totalFindings:
                        type: integer
                        description: Total number of findings.
                  organization:
                    type: object
                    properties:
                      name:
                        type: string
                        description: Organization name.
                      id:
                        type: string
                        description: Organization ID.
                  target:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Target ID.
                      name:
                        type: string
                        description: Target name.
                  eventTransactionId:
                    type: string
                    description: Unique ID of the event transaction.
                required:
                  - id
                  - severity
                  - serverTimestamp
                  - engine
                  - organization
                  - details
                  - target
              examples:
                Automatically created recommendation:
                  value:
                    id: 68f0017f-1286-414c-b65e-516271164564_0
                    severity: critical
                    engine: xmRecommendation
                    xmRecommendationKey: xmRecommendationAutomatic
                    action: none
                    acknowledged: false
                    details:
                      alertType: exposure.recommendation
                      recommendationDetails: Recommendation details
                      recommendationId: 84861497-de31-4528-aa91-ba4baee668dd
                      recommendationName: automatic beta
                      recommendationStatus: acceptedRisk
                      remediationEffort: '8'
                      remediationEffortString: High
                      remediationImpact: low
                      topAssets:
                        - id: 68f0017f-1286-414c-b65e-516271164564
                          assetType: host
                          name: host1
                          exposureRisk: 1
                          importance: high
                          businessContext: business context
                      totalAssets: 1
                      topFindings:
                        - id: 99a60a8b-48e9-4d24-8dd0-ea3d522ebba2
                          name: Finding 1
                      totalFindings: 1
                    organization:
                      name: CI-Test-Company-1
                      id: dc62ac4e-dbec-4901-a511-a1d6dfaddbc2
                    target:
                      id: dc62ac4e-dbec-4901-a511-a1d6dfaddbc2
                      name: CI-Test-Company-1
                    eventTransactionId: transaction-id
                    persistenceTimestamp: '2025-04-28T11:32:20.262Z'
                    serverTimestamp: '2025-04-28T11:32:19.440Z'
                    message: 'Risk was accepted for XM recommendation. Recommendation type: ''automatic beta'''
                    description: Exposure management recommendation event
