Retrieve a List of Users

Endpoint URL: https://<your server/rest/users
Endpoint URI: users

Action: GET

Retrieves a list of users.

Note

Ensure that you have logged into the Cybereason platform. For details, see Log in with the API.

You must add an Content-Type:application/json header with the request.

Note

If you are using cURL, add the authorization cookie details or the path to the file with cookie details with every request.

None

This request can return the following status codes:

200: Success OK with details on the operation

The response contains the following fields:

Field	Type	Description
lastUpdateTime	Integer	The timestamp (in milliseconds) when the user’s details were last updated.
totpEnabled	Boolean	Indicates whether two-factor authentication is enabled for this user.
isDailyNotifications	Boolean	Indicates whether the user will receive a daily summary of activity from their environment.
totpSid	String	The TFA key for this user to help set up TFA.
investigationViewConfig	Array	A collection of the columns defined for the user.
roles	Array	The assigned roles for the user. Possible values include: analyst_l1 (Analyst L1) analyst_l2 (Analyst L2) analyst_l3 (Analyst L3) analyst_hdl (HDL Analyst) executive (Executive) sys_admin (System Admin) user_admin (User Admin) api (API user) responder (Responder L1) policies_admin (Policy Admin) sensor_admin_l1 (Sensor Admin L1) local_analyst_l1 (Local Analyst L1) local_analyst_l2 (Local Analyst L2) responder_l2 (Responder L2) sensors_viewer (Sensor Viewer) local_responder (Local Responder) The Sensor viewer role is disabled by default. Open a Technical Support case to enable this role.
userClassification	String	Special characters associated with the user to help auditing of user activities. The user classification feature is not generally available. Contact your Customer Success Manager to gain access to this feature.
allowedLoginMethod	Enum	The way in which the user can log in. Possible values include: PASSWORD SSO In order to use the SSO option, you must enable SSO in your environment. For details on SSO authentication, see SSO Authentication in the Cybereason product documentation.
creationTime	Integer	The timestamp (in milliseconds) when the user was created.
groups	String	A collection of the groups to which the user has privileges to view information. This field returns a list of names only if the user has been assigned the local_analyst_l1, local_analyst_l2, or local_responder roles.**
changePasswordOnNextLogin	Boolean	Indicates whether the user will be required to update their password the next time they log in.
locked	Boolean	Indicates whether this user is locked.
creationTime	Integer	The timestamp (in milliseconds) when the user was created.
locale	String	The locale for the user reported by the operating system.
username	String	The email address for the user.

None

Important information is found in these fields:

username: The user name for the user. This is the address they use to log in to the Cybereason console.
totpEnabled: Whether or not two-factor authentication (TFA) is enabled for the user. If TFA is enabled, this user will need to set up a TOTP password in an authentication program or app.
totpSid: Thhe TFA secret key for the user. This key is required to set up the TOTP authentication code.
allowedLoginMethod: The type of authentication for the user.
roles: The list of roles assigned to this user.

Request

curl --request POST \
    --url https://12.34.56.78/rest/users \
    --header 'Content-Type:application/json' \

Response

This response has been shortened to show a single example of the fields for a user. A real response would contain many more users than this response.

[
    {
        "lastUpdateTime":1660648272768,
        "totpEnabled":false,
        "isDailyNotifications":false,
        "totpSid":null,
        "investigationViewConfig":null,
        "roles":["executive","user_admin","policies_admin","sys_admin","analyst_l3","responder"],
        "userClassification":null,
        "allowedLoginMethod":"PASSWORD",
        "groups":[],
        "changePasswordOnNextLogin":false,
        "locked":false,
        "creationTime":1660648272768,
        "locale":null,
        "username":"[email protected]"
    }
]

Request

Response

[
    {
        "lastUpdateTime":1660648272768,
        "totpEnabled":false,
        "isDailyNotifications":false,
        "totpSid":null,
        "investigationViewConfig":null,
        "roles":["executive","user_admin","policies_admin","sys_admin","analyst_l3","responder"],
        "userClassification":null,
        "allowedLoginMethod":"PASSWORD",
        "groups":[],
        "changePasswordOnNextLogin":false,
        "locked":false,
        "creationTime":1660648272768,
        "locale":null,
        "username":"[email protected]"
    }
]

Request

Download Python script

Depending on your browser settings, this linked file may open in a separate tab instead of downloading directly to your machine. If this happens, use the Save As option in your browser to save the file locally.

import requests
import json

# Login information

username = "[email protected]"
password = "mypassword"
server = "yourserver.com"
port = "443"

data = {
    "username": username,
    "password": password
}

headers = {"Content-Type": "application/json"}

base_url = "https://" + server + ":" + port

login_url = base_url + "/login.html"

session = requests.session()

login_response = session.post(login_url, data=data, verify=True)

print (login_response.status_code)
print (session.cookies.items())

# Request URL

endpoint_url = "/rest/users"

api_url = base_url + endpoint_url

api_response = session.request("GET", api_url, headers=headers)

your_response = json.loads(api_response.content)

print(json.dumps(your_response, indent=4, sort_keys=True))

Response

[
    {
        "lastUpdateTime":1660648272768,
        "totpEnabled":false,
        "isDailyNotifications":false,
        "totpSid":null,
        "investigationViewConfig":null,
        "roles":["executive","user_admin","policies_admin","sys_admin","analyst_l3","responder"],
        "userClassification":null,
        "allowedLoginMethod":"PASSWORD",
        "groups":[],
        "changePasswordOnNextLogin":false,
        "locked":false,
        "creationTime":1660648272768,
        "locale":null,
        "username":"[email protected]"
    }
]