openapi: 3.1.0
info:
  title: Varonis DatAlert Alerts Threat Models API
  description: API for accessing threat detection and incident response capabilities from Varonis DatAlert. Provides endpoints for retrieving alerts, managing alert status, adding notes to alerts, and accessing alerted events for investigation and threat hunting. The DatAlert API enables integration with SIEM and SOAR platforms for centralized security operations.
  version: '1.0'
  contact:
    name: Varonis Support
    url: https://www.varonis.com/resources/support
  termsOfService: https://www.varonis.com/terms
  license:
    name: Proprietary
    url: https://www.varonis.com/terms
servers:
- url: https://{domain}/api
  description: Varonis SaaS Instance
  variables:
    domain:
      default: your-instance.varonis.io
      description: The domain of your Varonis SaaS instance, typically in the format your-instance.varonis.io.
security:
- apiKeyHeader: []
tags:
- name: Threat Models
  description: Retrieve threat model definitions used to generate alerts, including categories and severity levels.
paths:
  /threatdetection/api/alert/alert/GetThreatModels:
    get:
      operationId: getThreatModels
      summary: Varonis Get Threat Models
      description: Retrieves the list of threat models configured in Varonis DatAlert. Threat models define the behavioral patterns and rules used to generate alerts. Each threat model includes a name, category, severity level, and source classification. Supports optional filtering by name with wildcard support.
      tags:
      - Threat Models
      parameters:
      - $ref: '#/components/parameters/ThreatModelName'
      responses:
        '200':
          description: Successfully retrieved threat models
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatModelsResponse'
              examples:
                getThreatModels200Example:
                  summary: Default getThreatModels 200 response
                  x-microcks-default: true
                  value:
                    threatModels:
                    - id: example-string
                      name: example-string
                      category: example-string
                      severity: Low
                      source: example-string
        '401':
          description: Unauthorized - invalid or missing API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                getThreatModels401Example:
                  summary: Default getThreatModels 401 response
                  x-microcks-default: true
                  value:
                    error: example-string
                    message: example-string
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ThreatModelsResponse:
      type: object
      properties:
        threatModels:
          type: array
          items:
            $ref: '#/components/schemas/ThreatModel'
          description: Array of threat model objects.
    ThreatModel:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the threat model.
        name:
          type: string
          description: Display name of the threat model.
        category:
          type: string
          description: Category classification of the threat model aligned with MITRE ATT&CK framework.
        severity:
          type: string
          enum:
          - Low
          - Medium
          - High
          description: Default severity level assigned to alerts generated by this model.
        source:
          type: string
          description: Source or origin of the threat model such as built-in or custom.
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Error code identifying the type of error.
        message:
          type: string
          description: Human-readable description of the error.
  parameters:
    ThreatModelName:
      name: name
      in: query
      required: false
      description: Filter threat models by name. Supports pipe-separated values and wildcard characters for pattern matching.
      schema:
        type: string
        example: Abnormal*
  securitySchemes:
    apiKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for authenticating with the Varonis DatAlert API. Generate an API key from the Varonis Web Interface under Configuration, then API Keys. The key must have the Threat Detection Integrator role.
externalDocs:
  description: Varonis Help Center
  url: https://help.varonis.com/s/