# authorship: generated by API Evangelist tooling. Stamped 2026-08-18 # on the file's own generator header (roadmap#64). An unmarked file is # NOT assumed to be ours -- absence of evidence was never stamped. method: generated vocabulary: "1.0.0" info: provider: "Varonis" description: "Unified vocabulary for Varonis Data Security Platform APIs, mapping operational dimensions from the DatAlert API to capability workflows for SOC analyst use cases." created: "2026-05-03" modified: "2026-05-03" operational: apis: - namespace: varonis-datalert name: Varonis DatAlert API version: "1.0" baseUrl: "https://{domain}/api" status: active resources: - name: alerts api: varonis-datalert actions: [get-alerts, update-alert-status, close-alert, add-alert-note] description: "Security alerts generated by the DatAlert threat detection engine." - name: events api: varonis-datalert actions: [get-alerted-events] description: "Forensic event data associated with security alerts for investigation." - name: threat-models api: varonis-datalert actions: [get-threat-models] description: "Behavioral patterns and rule definitions used to generate alerts." actions: - name: get-alerts httpMethod: POST pattern: query description: "Retrieve and filter security alerts by threat model, severity, status, and time range." - name: update-alert-status httpMethod: POST pattern: write description: "Transition an alert between Open and Under Investigation states." - name: close-alert httpMethod: POST pattern: write description: "Close an alert with a resolution reason." - name: add-alert-note httpMethod: POST pattern: write description: "Add an investigation note to document findings." - name: get-alerted-events httpMethod: POST pattern: query description: "Retrieve forensic events associated with an alert." - name: get-threat-models httpMethod: GET pattern: read description: "List threat model definitions." schemas: core: - name: Alert description: "Security alert with severity, category, status, user, device, and asset path." keyProperties: [id, name, time, severity, category, status, userName, deviceName, platform] - name: AlertedEvent description: "Forensic event record showing operation type, accounts, resource, and IP address." keyProperties: [id, time, operationType, sourceAccount, destinationAccount, resource, ipAddress] - name: ThreatModel description: "Threat model definition with MITRE ATT&CK category and severity." keyProperties: [id, name, category, severity, source] parameters: pagination: - name: maxResults type: integer description: "Maximum number of results to return (max 5000)." - name: offset type: integer description: "Number of results to skip for pagination." filters: - name: alertStatus type: array description: "Filter by alert status values." - name: alertSeverity type: array description: "Filter by alert severity levels." - name: threatModelName type: array description: "Filter by threat model names." - name: lastDays type: integer description: "Retrieve results from the last N days." enums: alert-status: - Open - Under Investigation - Closed alert-severity: - Low - Medium - High alert-category: - Reconnaissance - Intrusion - Exploitation - Privilege Escalation - Lateral Movement close-reason: - Resolved - Misconfiguration - Threat model disabled or deleted - Account misclassification - Legitimate activity - Other platform: - Windows - Exchange - SharePoint - DNS - Active Directory - Azure AD - Microsoft 365 authentication: schemes: - type: apiKey name: X-API-Key in: header description: "API key for authenticating with the Varonis DatAlert API." capability: workflows: - name: Threat Detection and Response file: capabilities/threat-detection-response.yaml description: "Unified workflow for SOC analysts to retrieve alerts, investigate events, manage alert lifecycle, and reference threat models." apisCombined: [varonis-datalert] toolCount: 6 personas: [SOC Analyst] domains: [Data Security, Incident Response] personas: - id: soc-analyst name: SOC Analyst description: "Security Operations Center analyst who monitors alerts, investigates incidents, and manages alert lifecycle." workflows: [Threat Detection and Response] domains: - name: Data Security description: "Protecting enterprise data from unauthorized access, exfiltration, and misuse." resources: [alerts, events, threat-models] - name: Incident Response description: "Processes for detecting, investigating, and resolving security incidents." resources: [alerts, events] namespaces: - name: varonis-datalert type: consumed description: "Varonis DatAlert REST API" - name: varonis-threat-response-api type: rest-exposed port: 8080 - name: varonis-threat-response-mcp type: mcp-exposed port: 9090 binds: - name: VARONIS_API_KEY description: "Varonis API key with Threat Detection Integrator role." workflows: [Threat Detection and Response] crossReference: - resource: alerts operations: [get-alerts, update-alert-status, close-alert, add-alert-note] workflows: [Threat Detection and Response] personas: [SOC Analyst] - resource: events operations: [get-alerted-events] workflows: [Threat Detection and Response] personas: [SOC Analyst] - resource: threat-models operations: [get-threat-models] workflows: [Threat Detection and Response] personas: [SOC Analyst]