Get container timeline history via REST

[bongo]

Hi.

I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports.

The closest endpoint I can find is briefly mentioned in the REST API documentation:

/rest/container/<container id>/actions

I can't find any other mention of this endpoint in the documentation. This endpoint is useful however it only provides action history, not analyst or playbook activity history.

The Phantom web portal calls an undocumented API which returns exactly what I need:

/rest/container/<container ID>/timeline?<many required query parameters>

...however it requires many query parameters. If you don't get the query parameters correct it returns empty results.

My questions:

1. Can someone refer me to documentation for the container timeline API endpoint mentioned above?

2. If not, is there an alternative "documented" endpoint that will return all container timeline information?

Thanks

[bongo · Accepted solution]

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}