Retrieve Sensor Actions

Endpoint URL: https://<your server>/rest/sensors/allActions
Endpoint URI: sensors/allActions

Action: GET

Returns a list of all the current or queued actions on sensors.

You must be assigned the System Admin role and Sensor Admin L1 role (if your Cybereason environment uses sensor grouping) to send requests to this endpoint URL.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

Request Headers

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file with cookie details with every request.

Request Body

None

Request Parameters

URL/URI parameters: none

Request Body Parameters: none

Response Status Codes

This request can return the following status codes:

• 200: Success OK or an error message saying why

Response Success Schema

Success: A list of all actions available for the sensor. The action name is found in the actionType field. For each action there is an actionArguments field.

The response contains the following objects and fields:

sensors Object

Parameter	Type	Description
finalState	Boolean	The final state for the specified action.
totalNumberofProbes	Integer	The number of sensors to which the action is pending or in progress.
initiatorUser	String	The user who started the specified action.
startTime	Timestamp	The time (in epoch) when the action was begun.
aborterUser	String	The user that aborted the specified action.
abortTime	String	The time (in epoch) when the action was aborted.
abortTimeout	Boolean	Indicates whether the action was aborted because of timeout settings on the sensor.
abortHttpStatusCode	Integer	The HTTP status code sent to the server when the action was aborted.

Response Failure Schema

None

Important Response Fields

Important information is found in these fields:

• batchID: The operation identifier for the sensor operation. For this operation you may have multiple batch ID values as this request returns details on all the operations in progress or waiting in your Cybereason server.

• actionType: The type of sensor operation. For this request to retrieve details on all sensor operations, this should report Abort

• stats object: This object contains details on the final result of the operation for the sensors included in the batch. View the different fields available in this object and the number of sensors to which this status applied.

• totalNumberOfProbes:* The total number of sensors to which this operation applied.

Example: Retrieve actions on sensors

CURLREST API ClientPython

Request

curl --request GET \
    --url https://12.34.56.78/rest/sensors/allActions \
    --header 'Content-Type:application/json' \

Response

 [
    {
        "batchId": -2012506538,
        "actionType": "Archive",
        "actionArguments": null,
        "globalStats": {
            "stats": {
                "Pending": 0,
                "partialResponse": 0,
                "AbortTimeout": 0,
                "EndedWithSensorTimeout": 0,
                "UnauthorizedUser": 0,
                "FailedSendingToServer": 0,
                "GettingChunks": 0,
                "NewerInstalled": 0,
                "SendingMsi": 0,
                "None": 0,
                "MsiSendFail": 0,
                "EndedWithInvalidParam": 0,
                "Failed": 0,
                "InProgress": 0,
                "Disconnected": 0,
                "Aborted": 0,
                "FailedSending": 0,
                "MsiFileCorrupted": 0,
                "UnknownProbe": 0,
                "NotSupported": 0,
                "Primed": 0,
                "ChunksRequired": 0,
                "ProbeRemoved": 0,
                "Started": 0,
                "EndedWithTooManySearches": 0,
                "TimeoutSending": 0,
                "InvalidState": 0,
                "Timeout": 0,
                "EndedWithUnknownError": 0,
                "AlreadyUpdated": 0,
                "EndedWithTooManyResults": 0,
                "Succeeded": 1
            }
        },
        "finalState": true,
        "totalNumberOfProbes": 1,
        "initiatorUser": "[email protected]",
        "startTime": 1524490335749,
        "aborterUser": null,
        "abortTime": 0,
        "abortTimeout": false,
        "abortHttpStatusCode": null
    }
]