Cyware Orchestrate

org.alerts (READ)

device (READ, EXECUTE, UPDATE, DELETE)

org (READ)

org.alerts (READ)

device(READ, EXECUTE, UPDATE, DELETE)

org(READ)

BACKGROUND_SCAN

BYPASS

UNINSTALL_SENSOR

DELETE_SENSOR

QUARANTINE

UPDATE_POLICY

UPDATE_SENSOR_VERSION

search= Device actions will be performed on the result set of this search

options.policy_id= Devices will be updated to this policy ID. This is required if action_type is set to “UPDATE_POLICY”

options.sensor_version= Devices will be updated to this sensor version. This is required if action_type is set to “UPDATE_SENSOR_VERSION”

options.toggle= Determines whether to toggle action. Allowed values are “ON” and “OFF”. This is required if action_type is set to “QUARANTINE”, “BYPASS”, “BACKGROUND_SCAN”

criteria = Map of criteria to filter results. Allowed values are “status”, “os”, “last_contact_time”, “ad_group_id”, “policy_id, id”, “target_priority”.

rows = For pagination, the maximum number of rows to return.

start = For pagination, begin returning results, starting with this row.

sort.field = Sorting preference for sorting fields. Allowed values are “target_priority”, “policy_name”, “name”, “last_contact_time”, “av_pack_version”.

sort.order = Sorting order for the field. Allowed values are “ASC”, “DESC”

exclusions = A list of sensor versions to exclude from the request results

criteria = Map of criteria to filter results. Allowed values are “target_value”, “not_blocked_threat_category”, “Device_os_version”, “policy_id”, “minimum_severity”, “legacy_alert_id”, “tag”, “id”, “run_state”, “threat_cause_vector”, “device_username”, “threat_id”, “device_id”, “device_os”, “create_time”, “kill_chain_status”, “group_results”, “process_sha256”, “policy_name”, “reputation”, “type”, “category”, “workflow”, “reason_code”, “device_name”, “process_name”, “blocked_threat_category”, “device_location”, “sensor_action”, “policy_applied”.

rows = For pagination, the maximum number of rows to return.

start = For pagination, begin returning results, starting with this row.

sort.field = Sorting preference for sorting fields. Allowed values are “first_event_time”, “last_event_time”, “severity”, “target_value”, =

sort.order = Sorting order preference for the field. Allowed values are “ASC”, “DESC”

Criteria = Map of criteria to filter results.

Allowed values: “threat_id”, “target_value”, “device_id”, “device_os_versions”, “policy_id”, “device_os”, “minimum_severity”, “create_time”, “legacy_alert_id”, “group_results”, “process_sha256”, “policy_name”, “reputation”, “type”, “id”, “category”, “device_username”, “device_name”, “tag”, “workflow”, “process_name”