Update security event

This method updates the status of a security event to open or closed

URL

 

The following characters are not supported in URL values: + & %

 

 

https://<IIS_Server_Ip>/PasswordVault/API/pta/API/Events/<security event id>

The following values can be added in the URL. None of them are mandatory.

Resource information

HTTP method

PATCH

Content type

application/json

Header parameter

Parameter

Authorization

Type

String

Description

The JWT token that identifies the session.

Valid values

A session token that was returned from the “Logon” method.

Body parameters

 
{
	"mStatus": "OPEN"
}

Parameter

mStatus

Type

Enum

Description

The new status of the event

Valid values

open or closed

Result

 
{
	"id": "444445e56bbb0b0a063f4444",
	"type": "PSMRiskyCommand",
	"score": 70,
	"createTime": 1586134861000,
	"lastUpdateTime": 1586134861000,
	"audits": [
		{
			"id": "5e3045e56bbb0b0a063fbbbb",
			"type": "PSM_SSH_COMMAND",
			"sensorType": "VAULT",
			"action": "PSM Command",
			"psmCommand": "bla",
			"createTime": 1586134861000,
			"vaultUser": "vuser",
			"account": {
				"accountAsStr": "hi2@example.cyber-ark.co.il",
				"type": "LOCAL_UNIX",
				"account": {
					"mTarget": {
						"mOriginalAddress": "10.1.8.182",
						"mResolvedAddress": {
							"mOriginalAddress": "10.1.8.182",
							"mAddress": "10.1.8.182",
							"mHostName": "cyber",
							"mFqdn": "example.cyber-ark.co.il"
						}
					},
					"mUser": "hi2"
				}
			},
			"source": {
				"mOriginalAddress": "1.1.1.1"
			},
			"target": {
				"mOriginalAddress": "10.1.8.182",
				"mResolvedAddress": {
					"mOriginalAddress": "10.1.8.182",
					"mAddress": "10.1.8.182",
					"mHostName": "cyber",
					"mFqdn": "example.cyber-ark.co.il"
				}
			},
			"cloudData": {}
		}
	],
	"additionalData": {
		"matchPatterns": "kill(.*)"
	},
	"mStatus": "CLOSED"
}

Parameter

id

Type

String

Description

Event ID

Parameter

type

Type

String

Description

Event type

Parameter

score

Type

Integer

Description

Event score

Parameter

createTime

Type

Double

Description

The creation date of the event (represented in seconds)

Parameter

lastUpdateTime

Type

Double

Description

The last time the event was updated (represented in seconds)

Parameter

audits

Type

Array

Description

Array of audits for the event

audits

Parameter

id

Type

String

Description

Audit ID

Parameter

type

Type

String

Description

Audit type

Parameter

sensorType

Type

String

Description

The type of the sensor that sent the audit

Parameter

action

Type

String

Description

The action of the audit. For example, Vault retrieve password, Vault logon, PSM risky command , and so on

Parameter

psmCommand

Type

String

Description

The risky activity

Parameter

createTime

Type

Double

Description

The creation date of the audit

Parameter

vaultUser

Type

String

Description

The Vault user who triggered the session

Parameter

account

Type

 

Description

The account used in the session

account

Parameter

accountAsStr

Type

String

Description

String representation of the account used in the session

Parameter

type

Description

String

Description

Account type

Parameter

account

Type

 

Description

Detailed account information

Parameter

mtarget

Type

String

Description

Detailed target account information

mtarget

Parameter

mOriginalAddress

Type

String

Description

The original address of the target machine

Parameter

mResolvedAddress

Type

 

Description

The resolved address obof the target machineject

mResolvedAddress

Parameter

mAddress

Type

String

Description

The address of the target machine

Parameter

mHostName

Type

String

Description

The host name of the target machine

Parameter

mFqdn

Type

String

Description

The Fqdn of the target machine

account

Parameter

source

Type

String

Description

The source of the audit

source

Parameter

mOriginalAddress

Type

String

Description

The original address that was sent as a source

Parameter

mResolvedAddress

Type

 

Description

The resolved address object

mResolvedAddress

Parameter

mAddress

Type

String

Description

The original address

Parameter

mHostName

Type

String

Description

The host name representation of the source address

Parameter

mFqdn

Type

String

Description

The Fqdn representation of the source address

account

Parameter

target

Type

String

Description

The target address of the audit

target

Parameter

mOriginalAddress

Type

String

Description

The original target address of the audit

Parameter

mResolvedAddress

Type

 

Description

The resolved target address as an object

mResolvedAddress

Parameter

mAddress

Type

String

Description

The original target address

Parameter

mHostName

Type

String

Description

The host name of the target address

Parameter

mFqdn

Type

String

Description

The Fqdn representation of the target address

additionalData

Parameter

mitigationAction

Type

String

Description

The mitigation action of the session, either terminate or suspend

Parameter

sessionIsLive

Type

String

Description

True or false indicator of whether the session is live

Parameter

matchPatterns

Type

String

Description

The matching patterns of the risky command audit

Parameter

sessionIDs

Type

Array of strings

Description

The session ID

Parameter

mStatus

Type

String

Description

The status of the security event (open or closed)