Splunk SOAR (f.k.a. Phantom)

Get container timeline history via REST

bongo
Explorer

Hi.

I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports.

The closest endpoint I can find is briefly mentioned in the REST API documentation:

/rest/container/<container id>/actions

I can't find any other mention of this endpoint in the documentation. This endpoint is useful however it only provides action history, not analyst or playbook activity history.

The Phantom web portal calls an undocumented API which returns exactly what I need:

/rest/container/<container ID>/timeline?<many required query parameters>

...however it requires many query parameters. If you don't get the query parameters correct it returns empty results.

My questions:

1. Can someone refer me to documentation for the container timeline API endpoint mentioned above?

2. If not, is there an alternative "documented" endpoint that will return all container timeline information?

Thanks

0 Karma
1 Solution

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

View solution in original post

0 Karma

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...