{ "openapi": "3.0.0", "info": { "title": "Alert Manager API", "version": "1.0" }, "paths": { "/alerts": { "post": { "operationId": "Create an alert", "description": "Creates and activates an alert.", "requestBody": { "content": { "application/json": { "schema": { "description": "Alert payload", "example": { "_source": "DC4A6F3B-479B-4D42-B7DD-132C56E9C76B", "_sourceTimeStamp": 344168, "context": { "planId": "00000000-0000-0000-0000-000000000000", "resourceId": "00000000-0000-0000-0000-000000000001" }, "createdAt": "2019-09-05T16:24:35.000Z", "details": { "daysPassed": 32, "errorMessage": { "kbLink": { "serCode": "NoBackupForXDays" } }, "planId": "796c399a-a230-46c1-b705-31d590b9ef07", "planName": "Acme SQL to Cloud storage", "resourceId": "E10FC321-7900-63B3-3797-8969AB0756B1", "resourceName": "mssql://acme/khlon_afcab63a_3cf7_4b68_81ac_f71461a58b28_bureau_company7@2fe55c7d-ff5c-4477-98e8-d41c06443e46" }, "id": "1BE7BE26-C68F-0863-2F55-DACC93A799F9", "type": "NoBackupForXDays" }, "anyOf": [ { "description": "An alert that is raised if GreatHorn email security has detected a malicious email message.", "type": "object", "required": [ "details", "type" ], "properties": { "_sourceTimeStamp": { "type": "integer", "format": "int64" }, "_source": { "description": "Identifier of the alert producer.", "type": "string" }, "context": { "$ref": "#/components/schemas/Context" }, "createdAt": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/uuid" }, "details": { "description": "Alert type specific payload", "type": "object", "required": [ "resource", "emailSubject", "scanResult", "emailFrom", "detectionCategory" ], "properties": { "resource": { "description": "Mailbox name", "type": "string" }, "emailSubject": { "type": "string" }, "scanResult": { "type": "string" }, "emailFrom": { "type": "string" }, "detectionCategory": { "description": "Phishing, spam, malware, BEC, etc.", "type": "string" } } }, "tenantID": { "type": "string" }, "severity": { "description": "Alert severity level.", "enum": [ "ok", "information", "warning", "error", "critical" ], "type": "string" }, "type": { "description": "Alert type", "enum": [ "MaliciousEmailDetectedGreatHorn" ], "type": "string" }, "affinity": { "description": "Alert synchronization affinity (e.g., agent ID).", "type": "string" } } }, { "anyOf": [ { "description": "An alert that is raised if Perception Point email security has detected a potential threat in an email message.", "type": "object", "required": [ "details", "type" ], "properties": { "_sourceTimeStamp": { "type": "integer", "format": "int64" }, "_source": { "description": "Identifier of the alert producer.", "type": "string" }, "context": { "$ref": "#/components/schemas/Context" }, "createdAt": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/uuid" }, "details": { "description": "Alert type specific payload", "type": "object", "required": [ "resource", "emailSubject", "scanResult", "emailFrom", "detectionCategory" ], "properties": { "resource": { "description": "Mailbox name", "type": "string" }, "emailSubject": { "type": "string" }, "scanResult": { "type": "string" }, "emailFrom": { "type": "string" }, "detectionCategory": { "description": "Phishing, spam, malware, BEC, etc.", "type": "string" } } }, "tenantID": { "type": "string" }, "severity": { "description": "Alert severity level.", "enum": [ "ok", "information", "warning", "error", "critical" ], "type": "string" }, "type": { "description": "Alert type", "enum": [ "MaliciousEmailDetectedPerceptionPointError" ], "type": "string" }, "affinity": { "description": "Alert synchronization affinity (e.g., agent ID).", "type": "string" } } }, { "description": "An alert that is raised if Perception Point email security has detected a suspicious email message.", "type": "object", "required": [ "details", "type" ], "properties": { "_sourceTimeStamp": { "type": "integer", "format": "int64" }, "_source": { "description": "Identifier of the alert producer.", "type": "string" }, "context": { "$ref": "#/components/schemas/Context" }, "createdAt": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/uuid" }, "details": { "description": "Alert type specific payload", "type": "object", "required": [ "resource", "emailSubject", "scanResult", "emailFrom", "detectionCategory" ], "properties": { "resource": { "description": "Mailbox name", "type": "string" }, "emailSubject": { "type": "string" }, "scanResult": { "type": "string" }, "emailFrom": { "type": "string" }, "detectionCategory": { "description": "Phishing, spam, malware, BEC, etc.", "type": "string" } } }, "tenantID": { "type": "string" }, "severity": { "description": "Alert severity level.", "enum": [ "ok", "information", "warning", "error", "critical" ], "type": "string" }, "type": { "description": "Alert type", "enum": [ "MaliciousEmailDetectedPerceptionPointWarning" ], "type": "string" }, "affinity": { "description": "Alert synchronization affinity (e.g., agent ID).", "type": "string" } } } ] }, { "description": "No backup for X days.\n", "type": "object", "required": [ "details", "type" ], "properties": { "_sourceTimeStamp": { "type": "integer", "format": "int64" }, "_source": { "description": "Identifier of the alert producer.", "type": "string" }, "context": { "$ref": "#/components/schemas/Context" }, "createdAt": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/uuid" }, "details": { "description": "Alert type specific payload", "type": "object", "required": [ "resourceId", "planId", "daysPassed" ], "properties": { "planName": { "type": "string" }, "errorMessage": { "type": "object" }, "resourceId": { "type": "string" }, "resourceName": { "type": "string" }, "planId": { "type": "string" }, "daysPassed": { "type": "integer" } } }, "tenantID": { "type": "string" }, "severity": { "description": "Alert severity level.", "enum": [ "ok", "information", "warning", "error", "critical" ], "type": "string" }, "type": { "description": "Alert type", "enum": [ "NoBackupForXDays" ], "type": "string" }, "affinity": { "description": "Alert synchronization affinity (e.g., agent ID).", "type": "string" } } }, { "description": "Generic alert with arbitrary payload", "type": "object", "required": [ "details", "type" ], "properties": { "_sourceTimeStamp": { "type": "integer", "format": "int64" }, "_source": { "description": "Identifier of the alert producer.", "type": "string" }, "context": { "$ref": "#/components/schemas/Context" }, "createdAt": { "type": "string", "format": "date-time" }, "id": { "$ref": "#/components/schemas/uuid" }, "details": { "description": "Alert type specific payload", "type": "object" }, "tenantID": { "type": "string" }, "severity": { "description": "Alert severity level.", "enum": [ "ok", "information", "warning", "error", "critical" ], "type": "string" }, "type": { "description": "Alert type", "type": "string" }, "affinity": { "description": "Alert synchronization affinity (e.g., agent ID).", "type": "string" } } } ] } } } }, "responses": { "200": { "description": "ID of the created alert.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AlertID" } } } }, "400": { "description": "Alert is invalid, e.g. incompatible with the alert type definition.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Request is refused because authentication parameters are invalid.", "content": { "text/plain": { "schema": { "example": "\n
\n