Events

Container Security security and audit events

List evaluation events

get/events/evaluations

Retrieve a list of evaluation events. Events are returned in descending order based on the timestamp, with the latest event returned first.

SecurityTrend Micro Cloud One API Key

Request

query Parameters

action	string (Action) The policy action for the event. Enum: "allow" "block" "log" Example: action=block
clusterID	string When present, the `clusterID` query parameter will filter the list of events to those events where the `clusterID` is the provided value.
clusterName	string When present, the `clusterName` query parameter will filter the list of events to those events where the `clusterName` is the provided value.
cursor	string <byte> Default: "" An encoded value used to retrieve the next set of results for a query that returns more than `limit` results.
decision	string (Decision) The evaluation decision for the event. Enum: "allow" "deny" Example: decision=deny
fromTime	string <date-time> When present, the `fromTime` query parameter will filter the list of events to those events where the `timestamp` value is greater or equal to the provided date time value. Example: fromTime=2020-05-01T00:00:00Z
limit	integer <int64> <= 100 Default: 25 The maximum number of records to return.
mitigation	string (Mitigation) The policy mitigation action for the event. Enum: "log" "isolate" "terminate"
policyID	string When present, the `policyID` query parameter will filter the list of events to those events where the `policyID` is the provided value.
policyName	string When present, the `policyName` query parameter will filter the list of events to those events where the `policyName` is the provided value.
toTime	string <date-time> When present, the `toTime` query parameter will filter the list of events to those events where the `timestamp` value is less than or equal to the provided date time value. Example: toTime=2020-06-01T00:00:00Z

header Parameters

api-version

string

Default: v1

The version of the API to use.

Value: "v1"

Responses

200

The response body contains the event objects.

400

Something about your request didn't quite make sense. The error message should help you figure out what went wrong.

401

Did you forget to include an API Key in your request? You need to include a valid authentication header in your request. See API reference documentation for details on available authentication methods.

403

You tried to do something that you're not allowed to do, you naughty scamp. Check your privileges to see what you're actually allowed to do. This could also mean that your token has expired.

429

You have made too many requests too quickly. Check the Retry-After header for an indication of when you might be able to try again.

500

Something has gone terribly wrong. It's possible that trying again will help, but it's more likely that you're out of luck for the moment. Visit https://success.trendmicro.com/smb-new-request to raise a support ticket.

503

The service is temporarily unavailable, likely due to maintenance. It should be available soon, check the Retry-After header for an indication of when you might be able to try again.

Request samples

Shell/Curl
Node
Python3
Go

curl --request GET \
  --url 'https://container.us-1.cloudone.trendmicro.com/api/events/evaluations?cursor=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE&policyID=SOME_STRING_VALUE&policyName=SOME_STRING_VALUE&clusterID=SOME_STRING_VALUE&clusterName=SOME_STRING_VALUE&action=block&mitigation=SOME_STRING_VALUE&decision=deny&fromTime=SOME_STRING_VALUE&toTime=SOME_STRING_VALUE' \
  --header 'Authorization: REPLACE_KEY_VALUE'

Response samples

application/json

{"events": [{"id": "0uk1Hbc9dQ9pxyTqJ93IUrFhdGq",
"policyID": "30e53669-c8ef-4d0f-a8ff-3dbbb098d8ff",
"policyName": "nist",
"policyDefinitionName": "devNamespaces",
"clusterID": "prod_cluster-1txU1Sjd47Rb0e0iNF8hFZhDXYD",
"clusterName": "prod_cluster",
"timestamp": "2019-03-01T00:00:00Z",
"decision": "deny",
"kind": "Deployment",
"namespace": "production",
"requestID": "30e53669-c8ef-4d0f-a8ff-3dbbb098d8ff",
"reasons": [{"type": "podSecurityContext",
"rule": "equals",
"value": "docker.io",
"ruleProperties": {"ruleProperties": [{"key": "cvss-attack-vector",
"value": "network"
},
{"key": "max-severity",
"value": "high"
}
]
},
"action": "block",
"resources": [{"image": "docker.io/library/busybox",
"object": "busybox-pod",
"container": "busybox-container",
"command": "/usr/bin/bash -c \"echo hello world\"",
"findings": {"defcon1": null,
"critical": null,
"high": null,
"medium": null,
"low": null,
"negligible": null,
"unknown": null
}
}
]
}
],
"exceptions": {"type": "registry",
"rule": "equals",
"value": "gcr.io",
"action": "allow",
"resources": {"image": "gcr.io/google-containers/busybox",
"object": "busybox-pod",
"container": "busybox-container",
"findings": { }
}
},
"action": "block",
"operation": "CREATE"
}
],
"next": "dGhpcyB2YWx1ZSBpcyBvcGFxdWUsIGRlY29kaW5nIGl0IHdvbid0IGJlIHVzZWZ1bAo="
}

List audit events

get/events/audits

Retrieve a list of audit events. Events are returned in descending order based on the timestamp, with the latest event returned first.

SecurityTrend Micro Cloud One API Key

Request

query Parameters

clusterID	string When present, the `clusterID` query parameter will filter the list of events to those events where the `clusterID` is the provided value.
cursor	string <byte> Default: "" An encoded value used to retrieve the next set of results for a query that returns more than `limit` results.
fromTime	string <date-time> When present, the `fromTime` query parameter will filter the list of events to those events where the `timestamp` value is greater or equal to the provided date time value. Example: fromTime=2020-05-01T00:00:00Z
limit	integer <int64> <= 100 Default: 25 The maximum number of records to return.
priority	string When present, the `priority` query parameter will filter the list of events to those events where the `priority` is the provided value.
source	string When present, the `source` query parameter will filter the list of events to those events where the `source` is the provided value.
toTime	string <date-time> When present, the `toTime` query parameter will filter the list of events to those events where the `timestamp` value is less than or equal to the provided date time value. Example: toTime=2020-06-01T00:00:00Z

header Parameters

api-version

string

Default: v1

The version of the API to use.

Value: "v1"

Responses

200

The response body contains the event objects.

400

Something about your request didn't quite make sense. The error message should help you figure out what went wrong.

401

403

You tried to do something that you're not allowed to do, you naughty scamp. Check your privileges to see what you're actually allowed to do. This could also mean that your token has expired.

429

You have made too many requests too quickly. Check the Retry-After header for an indication of when you might be able to try again.

500

503

The service is temporarily unavailable, likely due to maintenance. It should be available soon, check the Retry-After header for an indication of when you might be able to try again.

Request samples

Shell/Curl
Node
Python3
Go

curl --request GET \
  --url 'https://container.us-1.cloudone.trendmicro.com/api/events/audits?cursor=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE&fromTime=SOME_STRING_VALUE&toTime=SOME_STRING_VALUE&source=SOME_STRING_VALUE&priority=SOME_STRING_VALUE&clusterID=SOME_STRING_VALUE' \
  --header 'Authorization: REPLACE_KEY_VALUE'

Response samples

application/json

{"events": [{"id": "0uk1Hbc9dQ9pxyTqJ93IUrFhdGq",
"timestamp": "2019-03-01T00:00:00Z",
"name": "Resource.NotFound",
"source": "scout",
"resources": [{"type": "clusterID",
"value": "prod_cluster-1txU1Sjd47Rb0e0iNF8hFZhDXYD"
}
],
"priority": "Highest",
"detail": "string",
"clusterID": "prod_cluster-1txU1Sjd47Rb0e0iNF8hFZhDXYD",
"clusterName": "prod_cluster",
"code": "AUDIT_EVENT_ID_A"
}
],
"next": "dGhpcyB2YWx1ZSBpcyBvcGFxdWUsIGRlY29kaW5nIGl0IHdvbid0IGJlIHVzZWZ1bAo="
}

List runtime sensor events

get/events/sensors

Retrieve a list of sensor events. Events are returned in descending order based on the timestamp, with the latest event returned first.

SecurityTrend Micro Cloud One API Key

Request

query Parameters

clusterID	string When present, the `clusterID` query parameter will filter the list of events to those events where the `clusterID` is the provided value.
clusterName	string When present, the `clusterName` query parameter will filter the list of events to those events where the `clusterName` is the provided value.
cursor	string <byte> Default: "" An encoded value used to retrieve the next set of results for a query that returns more than `limit` results.
fromTime	string <date-time> When present, the `fromTime` query parameter will filter the list of events to those events where the `timestamp` value is greater or equal to the provided date time value. Example: fromTime=2020-05-01T00:00:00.000000Z
limit	integer <int64> <= 100 Default: 25 The maximum number of records to return.
policyID	string When present, the `policyID` query parameter will filter the list of events to those events where the `policyID` is the provided value.
policyName	string When present, the `policyName` query parameter will filter the list of events to those events where the `policyName` is the provided value.
toTime	string <date-time> When present, the `toTime` query parameter will filter the list of events to those events where the `timestamp` value is less than or equal to the provided date time value. Example: toTime=2020-06-01T00:00:00.000000Z

header Parameters

api-version

string

Default: v1

The version of the API to use.

Value: "v1"

Responses

200

The response body contains the event objects.

400

Something about your request didn't quite make sense. The error message should help you figure out what went wrong.

401

403

You tried to do something that you're not allowed to do, you naughty scamp. Check your privileges to see what you're actually allowed to do. This could also mean that your token has expired.

429

You have made too many requests too quickly. Check the Retry-After header for an indication of when you might be able to try again.

500

503

The service is temporarily unavailable, likely due to maintenance. It should be available soon, check the Retry-After header for an indication of when you might be able to try again.

Request samples

Shell/Curl
Node
Python3
Go

curl --request GET \
  --url 'https://container.us-1.cloudone.trendmicro.com/api/events/sensors?cursor=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE&policyID=SOME_STRING_VALUE&policyName=SOME_STRING_VALUE&clusterID=SOME_STRING_VALUE&clusterName=SOME_STRING_VALUE&fromTime=SOME_STRING_VALUE&toTime=SOME_STRING_VALUE' \
  --header 'Authorization: REPLACE_KEY_VALUE'

Response samples

application/json

{"events": [{"id": "0uk1Hbc9dQ9pxyTqJ93IUrFhdGq",
"clusterID": "prod_cluster-1txU1Sjd47Rb0e0iNF8hFZhDXYD",
"clusterName": "prod_cluster",
"policyID": "mitre-1fhJJhPdbKbGK83VL4GjBsFrXIR",
"mitigation": "log",
"rulesets": [{"id": "example_ruleset1-1tzKCRBSj68GdVadAPcgtrWehA9",
"name": "example_ruleset1"
}
],
"policyName": "mitre",
"type": "syscall",
"ruleID": "FALCO-001234",
"name": "Falco rule name",
"severity": "notice",
"timestamp": "2019-03-01T00:00:00.000000Z",
"container.id": "e1427f611c93",
"container.image.tag": "latest",
"container.image.repository": "centos",
"container.image.digest": "sha256:5528e8b1b1719d34604c87e11dcd1c0a20bedf46e83b5632cdeac91b8c04efc",
"k8s.ns.name": "default",
"k8s.pod.name": "centos-f89b5984-dnqlr",
"k8s.pod.labels": {"environment": "dev"
},
"proc.cmdline": "curl www.google.com",
"proc.name": "curl",
"proc.pname": "runc",
"metadata": {"prop1": "value1"
},
"hostname": "ip-192-168-57-42.us-west-1.compute.internal",
"tags": ["network",
"mitre_discovery"
],
"details": "{\n\"k8s.pod.name\": \"centos-f89b5984-dnqlr\",\n\"k8s.pod.id\": \"fc550ed4-3b54-402a-a56d-46096c285660\",\n\"k8s.ns.name\": \"default\",\n\"k8s.pod.labels\": \"environment:dev\",\n\"container.id\": \"4102001853b8\",\n\"container.image.tag\": \"latest\",\n\"container.image.repository\": \"ubuntu\",\n\"container.image.digest\": \"sha256:626ffe58f6e7566e00254b638eb7e0f3b11d4da9675088f4781a50ae288f3322\",\n\"evt.num\": 2428981,\n\"evt.rawtime\": 1636662781671411028,\n\"evt.type\": \" fchmodat\",\n\"evt.category\": \"file\",\n\"proc.pid\": 9864,\n\"proc.exe\": \"chmod\",\n\"proc.args\": \"+x /tmp/data\",\n\"proc.cmdline\": \"bash\",\n\"proc.name\": \"chmod\",\n\"proc.ppid\": 9697,\n\"proc.pcmdline\": \"bash\",\n\"proc.pname\": \"bash\",\n\"fd.num\": 123,\n\"fd.name\": \"/tmp/file\"\n}"
}
],
"next": "dGhpcyB2YWx1ZSBpcyBvcGFxdWUsIGRlY29kaW5nIGl0IHdvbid0IGJlIHVzZWZ1bAo="
}

➔ Next to Rules