Splunk SOAR (f.k.a. Phantom)

Get container timeline history via REST

bongo
Explorer

Hi.

I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports.

The closest endpoint I can find is briefly mentioned in the REST API documentation:

/rest/container/<container id>/actions

I can't find any other mention of this endpoint in the documentation. This endpoint is useful however it only provides action history, not analyst or playbook activity history.

The Phantom web portal calls an undocumented API which returns exactly what I need:

/rest/container/<container ID>/timeline?<many required query parameters>

...however it requires many query parameters. If you don't get the query parameters correct it returns empty results.

My questions:

1. Can someone refer me to documentation for the container timeline API endpoint mentioned above?

2. If not, is there an alternative "documented" endpoint that will return all container timeline information?

Thanks

0 Karma
1 Solution

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

View solution in original post

0 Karma

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...