Splunk SOAR (f.k.a. Phantom)

Get container timeline history via REST

bongo
Explorer

Hi.

I need to extract container timeline events via the REST API in order to generate analyst, playbook and action timeline reports.

The closest endpoint I can find is briefly mentioned in the REST API documentation:

/rest/container/<container id>/actions

I can't find any other mention of this endpoint in the documentation. This endpoint is useful however it only provides action history, not analyst or playbook activity history.

The Phantom web portal calls an undocumented API which returns exactly what I need:

/rest/container/<container ID>/timeline?<many required query parameters>

...however it requires many query parameters. If you don't get the query parameters correct it returns empty results.

My questions:

1. Can someone refer me to documentation for the container timeline API endpoint mentioned above?

2. If not, is there an alternative "documented" endpoint that will return all container timeline information?

Thanks

0 Karma
1 Solution

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

View solution in original post

0 Karma

bongo
Explorer

After some experimentation I found that the endpoint will return all data if passed the following general JSON object after it's converted to a query string:

{
"page_number": 1,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
"count": 10000,
"artifact": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"event": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"playbook": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
},
"action": {
"count": 10000,
"min_time": "2018-01-01T00:00:00.000000Z",
"max_time": "2038-01-01T00:00:00.000000Z",
}
}

 

For example:

/rest/container/<container ID>/timeline?query_params={"page_number":1,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z","count":10000,"artifact":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"event":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"playbook":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"},"action":{"count":10000,"min_time":"2018-01-01T00:00:00.000000Z","max_time":"2038-01-01T00:00:00.000000Z"}}

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...