Events

Kubernetes Admission Controller policy events

list evaluation events

get/events/evaluations

Retrieve a list of evaluation events. Events are returned in descending order based on the timestamp, with the latest event returned first.

Request
query Parameters
action
string (Action)

The policy action for the event.

Enum: "allow" "block" "log"
Example: action=block
clusterID
string

When present, the clusterID query parameter will filter the list of events to those events where the clusterID is the provided value.

clusterName
string

When present, the clusterName query parameter will filter the list of events to those events where the clusterName is the provided value.

cursor
string <byte>
Default: ""

An encoded value used to retrieve the next set of results for a query that returns more than limit results.

decision
string (Decision)

The evaluation decision for the event.

Enum: "allow" "deny"
Example: decision=deny
fromTime
string <date-time>

When present, the fromTime query parameter will filter the list of events to those events where the timestamp value is greater or equal to the provided date time value.

Example: fromTime=2020-05-01T00:00:00Z
limit
integer <int64> <= 100
Default: 25

The maximum number of records to return.

mitigation
string (Mitigation)

The policy mitigation action for the event.

Enum: "log" "isolate" "terminate"
policyID
string

When present, the policyID query parameter will filter the list of events to those events where the policyID is the provided value.

policyName
string

When present, the policyName query parameter will filter the list of events to those events where the policyName is the provided value.

toTime
string <date-time>

When present, the toTime query parameter will filter the list of events to those events where the timestamp value is less than or equal to the provided date time value.

Example: toTime=2020-06-01T00:00:00Z
header Parameters
api-version
string
Default: v1

The version of the API to use.

Value: "v1"
Responses
200

The response body contains the event objects.

400

Something about your request didn't quite make sense. The error message should help you figure out what went wrong.

401

Did you forget to include an API Key in your request? You need to include a valid authentication header in your request. See API reference documentation for details on available authentication methods.

403

You tried to do something that you're not allowed to do, you naughty scamp. Check your privileges to see what you're actually allowed to do. This could also mean that your token has expired.

429

You have made too many requests too quickly. Check the Retry-After header for an indication of when you might be able to try again.

500

Something has gone terribly wrong. It's possible that trying again will help, but it's more likely that you're out of luck for the moment. Visit https://success.trendmicro.com/smb-new-request to raise a support ticket.

503

The service is temporarily unavailable, likely due to maintenance. It should be available soon, check the Retry-After header for an indication of when you might be able to try again.

Request samples
curl --request GET \
  --url 'https://container.us-1.cloudone.trendmicro.com/api/events/evaluations?cursor=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE&policyID=SOME_STRING_VALUE&policyName=SOME_STRING_VALUE&clusterID=SOME_STRING_VALUE&clusterName=SOME_STRING_VALUE&action=block&mitigation=SOME_STRING_VALUE&decision=deny&fromTime=SOME_STRING_VALUE&toTime=SOME_STRING_VALUE' \
  --header 'Authorization: REPLACE_KEY_VALUE'
Response samples
application/json
{
  • "events": [
    ],
  • "next": "dGhpcyB2YWx1ZSBpcyBvcGFxdWUsIGRlY29kaW5nIGl0IHdvbid0IGJlIHVzZWZ1bAo="
}

list audit events

get/events/audits

Retrieve a list of audit events. Events are returned in descending order based on the timestamp, with the latest event returned first.

Request
query Parameters
clusterID
string

When present, the clusterID query parameter will filter the list of events to those events where the clusterID is the provided value.

cursor
string <byte>
Default: ""

An encoded value used to retrieve the next set of results for a query that returns more than limit results.

fromTime
string <date-time>

When present, the fromTime query parameter will filter the list of events to those events where the timestamp value is greater or equal to the provided date time value.

Example: fromTime=2020-05-01T00:00:00Z
limit
integer <int64> <= 100
Default: 25

The maximum number of records to return.

priority
string

When present, the priority query parameter will filter the list of events to those events where the priority is the provided value.

source
string

When present, the source query parameter will filter the list of events to those events where the source is the provided value.

toTime
string <date-time>

When present, the toTime query parameter will filter the list of events to those events where the timestamp value is less than or equal to the provided date time value.

Example: toTime=2020-06-01T00:00:00Z
header Parameters
api-version
string
Default: v1

The version of the API to use.

Value: "v1"
Responses
200

The response body contains the event objects.

400

Something about your request didn't quite make sense. The error message should help you figure out what went wrong.

401

Did you forget to include an API Key in your request? You need to include a valid authentication header in your request. See API reference documentation for details on available authentication methods.

403

You tried to do something that you're not allowed to do, you naughty scamp. Check your privileges to see what you're actually allowed to do. This could also mean that your token has expired.

429

You have made too many requests too quickly. Check the Retry-After header for an indication of when you might be able to try again.

500

Something has gone terribly wrong. It's possible that trying again will help, but it's more likely that you're out of luck for the moment. Visit https://success.trendmicro.com/smb-new-request to raise a support ticket.

503

The service is temporarily unavailable, likely due to maintenance. It should be available soon, check the Retry-After header for an indication of when you might be able to try again.

Request samples
curl --request GET \
  --url 'https://container.us-1.cloudone.trendmicro.com/api/events/audits?cursor=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE&fromTime=SOME_STRING_VALUE&toTime=SOME_STRING_VALUE&source=SOME_STRING_VALUE&priority=SOME_STRING_VALUE&clusterID=SOME_STRING_VALUE' \
  --header 'Authorization: REPLACE_KEY_VALUE'
Response samples
application/json
{
  • "events": [
    ],
  • "next": "dGhpcyB2YWx1ZSBpcyBvcGFxdWUsIGRlY29kaW5nIGl0IHdvbid0IGJlIHVzZWZ1bAo="
}

list runtime sensor events

get/events/sensors

Retrieve a list of sensor events. Events are returned in descending order based on the timestamp, with the latest event returned first.

Request
query Parameters
clusterID
string

When present, the clusterID query parameter will filter the list of events to those events where the clusterID is the provided value.

clusterName
string

When present, the clusterName query parameter will filter the list of events to those events where the clusterName is the provided value.

cursor
string <byte>
Default: ""

An encoded value used to retrieve the next set of results for a query that returns more than limit results.

fromTime
string <date-time>

When present, the fromTime query parameter will filter the list of events to those events where the timestamp value is greater or equal to the provided date time value.

Example: fromTime=2020-05-01T00:00:00.000000Z
limit
integer <int64> <= 100
Default: 25

The maximum number of records to return.

policyID
string

When present, the policyID query parameter will filter the list of events to those events where the policyID is the provided value.

policyName
string

When present, the policyName query parameter will filter the list of events to those events where the policyName is the provided value.

toTime
string <date-time>

When present, the toTime query parameter will filter the list of events to those events where the timestamp value is less than or equal to the provided date time value.

Example: toTime=2020-06-01T00:00:00.000000Z
header Parameters
api-version
string
Default: v1

The version of the API to use.

Value: "v1"
Responses
200

The response body contains the event objects.

400

Something about your request didn't quite make sense. The error message should help you figure out what went wrong.

401

Did you forget to include an API Key in your request? You need to include a valid authentication header in your request. See API reference documentation for details on available authentication methods.

403

You tried to do something that you're not allowed to do, you naughty scamp. Check your privileges to see what you're actually allowed to do. This could also mean that your token has expired.

429

You have made too many requests too quickly. Check the Retry-After header for an indication of when you might be able to try again.

500

Something has gone terribly wrong. It's possible that trying again will help, but it's more likely that you're out of luck for the moment. Visit https://success.trendmicro.com/smb-new-request to raise a support ticket.

503

The service is temporarily unavailable, likely due to maintenance. It should be available soon, check the Retry-After header for an indication of when you might be able to try again.

Request samples
curl --request GET \
  --url 'https://container.us-1.cloudone.trendmicro.com/api/events/sensors?cursor=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE&policyID=SOME_STRING_VALUE&policyName=SOME_STRING_VALUE&clusterID=SOME_STRING_VALUE&clusterName=SOME_STRING_VALUE&fromTime=SOME_STRING_VALUE&toTime=SOME_STRING_VALUE' \
  --header 'Authorization: REPLACE_KEY_VALUE'
Response samples
application/json
{
  • "events": [
    ],
  • "next": "dGhpcyB2YWx1ZSBpcyBvcGFxdWUsIGRlY29kaW5nIGl0IHdvbid0IGJlIHVzZWZ1bAo="
}