Splunk SOAR (f.k.a. Phantom)

Get container timeline history via REST

bongo
Explorer

Hi.

I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports.

The closest endpoint I can find is briefly mentioned in the REST API documentation:

/rest/container/<container id>/actions

I can't find any other mention of this endpoint in the documentation. This endpoint is useful however it only provides action history, not analyst or playbook activity history.

The Phantom web portal calls an undocumented API which returns exactly what I need:

/rest/container/<container ID>/timeline?<many required query parameters>

...however it requires many query parameters. If you don't get the query parameters correct it returns empty results.

My questions:

1. Can someone refer me to documentation for the container timeline API endpoint mentioned above?

2. If not, is there an alternative "documented" endpoint that will return all container timeline information?

Thanks

0 Karma
1 Solution

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

View solution in original post

0 Karma

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...