GET /siem/offense_types/{offense_type_id}

Retrieve an offense type structure that describes the properties of an offense type.

Retrieve an Offense Type

Table 1. GET /siem/offense_types/{offense_type_id} resource details
MIME Type
application/json

Table 2. GET /siem/offense_types/{offense_type_id} request parameter details
Parameter	Type	Optionality	Data Type	MIME Type	Description
offense_type_id	path	Required	Number (Integer)	text/plain	Required - int - The offense type id.
fields	query	Optional	String	text/plain	Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.

Table 3. GET /siem/offense_types/{offense_type_id} response codes
HTTP Response Code	Unique Code	Description
200		The requested offense type has been retrieved.
404	1002	The requested offense type cannot be found.
422	1005	A request parameter is not valid.
500	1020	An error occurred while attempting to retrieve the requested offense type.

Response Description

The Offense Type with the entered offense_type_id.

id - Number - The ID of the offense type and what is presented in the offense's offense_type.
property_name - String - The name of the of the event or flow property represented by this offense type for flow or event properties or the unique identifier for custom flow or event properties.
name - String - The offense type's name.
database_type - String - Database where this type is present. Possible values are: EVENTS, FLOWS, or COMMON (if it belongs to both events and flows)
custom - boolean - True if the offense type is based on a custom flow or event property.

Response Sample


{
    "custom": true,
    "database_type": "String <one of: EVENTS, FLOWS, COMMON>",
    "id": 42,
    "name": "String",
    "property_name": "String"
}