Get Malop Labels

Endpoint URL: https://<your server>/rest/detection/labels
Endpoint URI: detection/labels

Action: POST

Returns a list of all Malop labels to use to label Malops.

This request is supported for versions 20.1.43 and later.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file containing the cookie details as part of every request.

Input: JSON

["<malop GUIDs>"]

You can add specific Malop GUID identifiers here as an optional selection, but if you do not, make sure to add square brackets with no data. Since this is a POST request, you must provide a request body.

URL/URI parameters: none

Request Body Parameters: You can add an optional list of Malop GUID strings (the unique identifiers used by the Cybereason platform to identify the Malop). If you do not want to select any specific Malops, add just the square brackets with no parameters.

This request can return the following status codes:

200: Success OK or an error message saying why

The response contains the following fields:

Field	Type	Description
id	Integer	The unique string the Cybereason platform assigns to the label.
labelText	String	The text used for the label.
totalCount	Integer	The total number of Malops to which the label is applied.
selectionCount	Integer	The number of Malops IDs added to the request as selected. The response always returns all labels for all Malops but this number reflects the Malops specifically entered.

None

Important information is found in these fields:

id parameter: The unique identifier the Cybereason platform assigns to the label. You may need this ID to perform other operations on labels.
labelText parameter: The string for the label.
totalCount parameter: The number of Malops with that label.

Return Malop labels

Request

curl --request GET \
        --url https://12.34.56.78/rest/detection/labels \
        --header 'Content-Type:application/json' \

Response

[
    {
        "id":1,
        "labelText":"New malop",
        "totalCount":17,
        "selectionCount":0
    },
    {
        "id":2,
        "labelText":"Triaged",
        "totalCount":80,
        "selectionCount":0
    },
    {
        "id":1,
        "labelText":"June incident",
        "totalCount":8,
        "selectionCount":0
    }
]

Request

Response

[
    {
        "id":1,
        "labelText":"New malop",
        "totalCount":17,
        "selectionCount":0
    },
    {
        "id":2,
        "labelText":"Triaged",
        "totalCount":80,
        "selectionCount":0
    },
    {
        "id":1,
        "labelText":"June incident",
        "totalCount":8,
        "selectionCount":0
    }
]

Request

Download example Python script

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

Use this request body:

import requests
import json

# Login information

username = "[email protected]"
password = "mypassword"
server = "yourserver.com"
port = "443"

data = {
    "username": username,
    "password": password
}

headers = {"Content-Type": "application/json"}

base_url = "https://" + server + ":" + port

login_url = base_url + "/login.html"

session = requests.session()

login_response = session.post(login_url, data=data, verify=True)

print (login_response.status_code)
print (session.cookies.items())

# Request URL

endpoint_url = "/rest/detection/labels"

api_url = base_url + endpoint_url

api_headers = {'Content-Type':'application/json'}

query = []

api_response = session.request("POST", api_url, data=query, headers=api_headers)

your_response = json.loads(api_response.content)

print(json.dumps(your_response, indent=4, sort_keys=True))

Response

[
    {
        "id":1,
        "labelText":"New malop",
        "totalCount":17,
        "selectionCount":0
    },
    {
        "id":2,
        "labelText":"Triaged",
        "totalCount":80,
        "selectionCount":0
    },
    {
        "id":1,
        "labelText":"June incident",
        "totalCount":8,
        "selectionCount":0
    }
]