GET /siem/milestones/{milestone_id}

Edit online

Retrieves an individual milestone by ID.

Retrieves an individual Attack timeline milestone object by milestoneId.

Table 1. GET /siem/milestones/{milestone_id} resource details
MIME Type

application/json

Table 2. GET /siem/milestones/{milestone_id} request parameter details
Parameter Type Optionality Data Type MIME Type Description

milestone_id

path

Required

Number (Integer)

text/plain

Required. The milestoneId of the milestone to retrieve.

fields

query

Optional

String

text/plain

Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.
Table 3. GET /siem/milestones/{milestone_id} response codes
HTTP Response Code Unique Code Description

200

The restore was retrieved.

403

1012

An error occurred due to Attack TimeLine feature disabled.

404

1001

The restore does not exist.

500

1000

An error occurred during the attempt to retrieve the restore.

Response Description

A MilestoneDTO object. The milestone object contains the following fields:
  • id - Long - The ID of the Milestone.
  • milestoneName - String - The user or authorized service that initiated the restore.
  • offenseId - Long - The Offense Id
  • startTimestamp - Long - The number of milliseconds since epoch when the milestone was started.
  • database - String - ?
  • milestoneTriggerBitmask - Long - ?
  • qid - Integer - ?
  • ruleId - Long - The rule id for which offense is generated
  • ruleName - String - The rule name for which offense is generated
  • logSourceId - Integer - The log source id
  • logSourceName - String - The log source name
  • flowSourceId - Integer - The flow source id
  • flowSourceName - String - The flow source name
  • lowLevelCategoryId - Short - The low level category id
  • lowLevelCategoryName - String - The low level category name
  • sourceIp - String - The source ip
  • destinationIp - String - The destination ip
  • username - String - User name
  • hostname - String - host name
  • sourceMacAddress - String - source MAC address
  • destinationMacAddress - String - destination MAC address
  • url - String - URL
  • fileName - String - The file name
  • fileHash - String - The file hash

Response Sample


{
    "database": "String",
    "destination_ip": "String",
    "destination_ip_changed": true,
    "destination_mac": "String",
    "display_id": 42,
    "external_log_source": true,
    "file_hash": "String",
    "file_name": "String",
    "flow_source_id": 42,
    "flow_source_name": "String",
    "flow_source_name_changed": true,
    "force_offense_creation": true,
    "hostname": "String",
    "id": 42,
    "log_source_id": 42,
    "log_source_name": "String",
    "log_source_name_changed": true,
    "low_level_category_id": 42,
    "low_level_category_name": "String",
    "milestone_name": "String",
    "offense_id": 42,
    "qid": 42,
    "rule_id": 42,
    "rule_name": "String",
    "rule_name_changed": true,
    "source_ip": "String",
    "source_ip_changed": true,
    "source_mac": "String",
    "start_timestamp": 42,
    "url": "String",
    "username": "String",
    "username_changed": true
}