Event Integration Guide

The Argus events API provides endpoints for searching and fetching events, as well as event statistics.

The current Event API is V1.

Danger

The V2 API is under development, and requires user feedback before it is ready for production.

The Event API uses role based access control, so any search will be limited to the customers for which the user has permission to view events.

In addition, fetching events by case provides access to the events associated with that case, provided that the user has read access to the case.

Please read the General integration guide to learn the general concepts and common data structures used throughout the Argus API.

Tip

The Swagger API documentation is always up-to-date and lets you try out any query with your user session or an API-key.

contents

• Event Service v1
  • About the Event Service
  • Event Model
  • Fetch a single event
  • Searching for events
    • Advanced search
      • Searching by IP - CIDR ranges
  • Fetching events associated to a case
  • Fetching large amounts of events
    • Common for all strategies
    • Pulling events continuously
• Event Service v2
  • About the Event Service
  • Fetch a single event
  • Fetch the payload of an event
  • Fetch the PCAP of an event
  • Fetch the lineage of an event
  • Fetch events associated with a case
  • Search for events
    • Simple search
    • Advanced search
  • Event Statistics
  • Event assessment
  • Event assessment by compatibility path
  • Bulk assessment of events
  • Event Model
  • Payload Model
  • Endpoint Model
  • Timestamp Model
  • Case Model
  • Properties Model
  • Event Assessment Model
  • Event Bulk Assessment Model
  • Event Bulk Assessment Search Criteria
  • Event Bulk Assessment Response
  • Event Flags
• Submitting events via API
  • Notes about collector APIs:
  • Submitting an event
  • Submission response
  • Submitting an update
  • Submitting with properties
  • Submitting with flags
  • Submitting a bulk of events
  • Finalizing an event