ThreatSync Management API

Content-Type

application/json

Accept

application/json

Authorization

The access token that you generate with the WatchGuard Authentication API. For more information, go to Authentication.

WatchGuard-API-Key

The API key associated with your WatchGuard Cloud account (shown on the Managed Access page in WatchGuard Cloud).

sortBy
string

Specifies how to sort results. This can be the names of one or more response parameters, separated by commas.

Example: threatScore

limit

integer

Specifies the maximum number of records to retrieve in the response. The maximum is limited to 1000 records.

Example: 50

startAfter
string

Cursor value that identifies the record after which you want to retrieve records. This value must match the data returned in the response parameter you specify in the sortBy request parameter.

Example: 2023-02-12T23:05:28

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

query
string

Query string that enables you to search for records that match the specified data. Specify response parameter names and associated values to retrieve objects that match those values.

Examples:

threatScore:>5 && status:viewed

category:malicious_url OR category:IPS OR category:IOA

status:performed OR status:inProgress

For more information about how to construct query strings, go to the Apache Lucene documentation.

sortBy
string

Specifies how to sort results. This can be the names of one or more response parameters, separated by commas.

Example: threatScore

sortOrder
string

Specifies whether to sort the results in ascending or descending order. This can be one of these values:

• asc — Sort results in ascending order
• desc — Sort results in descending order

If you do not specify a value, the API returns results in ascending order.

Example: desc

groupBy
string

Specifies the response parameter to group data by.

Example: status

fields
string

Specifies which response parameters to return in the results. If you do not specify a value, the API returns all response parameters.

Example : id,threatScore,status

countOnly
boolean

Specifies whether to retrieve only a count of records.

Example: true

limit
integer

Maximum number of records to retrieve in the response. The maximum is limited to 1000 records.

Example: 50

startAfter
string

Cursor value that identifies the record after which you want to retrieve records. This value must match the data returned in the response parameter you specify in the sortBy request parameter.

Example: 2023-02-12T23:05:28

duration
string

Duration of time in days to retrieve records for. Specify a number followed by the letter D.

Example: 10D

tenants
boolean

Specifies whether to retrieve data for both Service Provider and managed accounts.

Set this value to true to retrieve data for all managed accounts and delegated accounts.

The default value is false.

Example: true

includeActions
boolean

Specifies whether to include actions for an incident.

The default value is false.

Example: true

includeComments
boolean

Specifies whether to include comments for an incident.

The default value is false.

Example: true

items
array

Array of incident items.

id
string

Unique identifier of the incident record.

Example: cjo38rng0qbgs12ehiqg

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

category
string

Category of the incident. This can be one of these values:

• AV
• Exploit
• IPS
• IOA
• Malicious Access Point
• Malicious URL
• Malware
• Unknown Program

Example: malware

type
string

Type of malware detected.

Example: SecurityR.TestFile

timestamp
string

Date and time the incident was created.

Example: 2022-03-17T00:05:16Z

threatScore
integer

Threat score of the incident.

Example: 7

severity
string

The risk score category. This can be one of these values:

• Critical — Scores of 9 or 10
• High — Scores of 7 or 8
• Medium — Scores of 4, 5, or 6
• Low — Scores of 1, 2, or 3

Example: medium

description
string

Description of the threat detected.

Example: Intrusion was detected by the Firebox IPS engine

remediated
boolean

Remediation status of the incident.

Example: true

entities
object

Details of the entity that the incident belongs to.

id
string

Unique identifier for the entity.

Example: 14359

type
string

Type of entity.

Example: Firebox

recommendedActions
array

List of recommended actions that can be performed on the incident.

command
string

Name of the recommended action to perform. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• isolate — Isolates an endpoint-protected computer.
• unIsolate — Unisolates an isolated computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.

Example: isolate

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block
• unblockAddress — Required parameters:
  • address — The IP address to unblock
• isolate — No required parameters.
• unIsolate — No required parameters.
• killProcess — One of these parameters required:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

actionPerformed
array

List of actions performed at the source (Firebox or Endpoint) in response to the threat.

command
string

Name of the action performed. This can be one of these values:

• blockConnection — The Firebox blocked a connection.
• blockProcess — The endpoint agent prevented a process from running.
• deleteFile — The endpoint agent deleted a file on the host computer.
• detected — The access point detected a threat.
• killProcess — The endpoint agent ended a running process on the host computer.

Example: deleteFile

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — Parameters can include
  • md5 — The MD5 hash associated with the process.

threatDetails
object

Threat details of an incident. The parameters depend on the type of threat and can include one or more of these values:

Access Point

• deviceId — The device ID of the access point that detected the threat.
• threatWiredMac — The MAC address of the wired interface of the Rogue access point.
• rssi — The RSSI (Received Signal Strength Indicator) of the malicious access point.
• agentIp — The IP address of the access point that detected the threat.
• band — The wireless band used by the Rogue access point, such as 2.4 GHz or 5 GHz.
• channel — The wireless channel used by the Rogue access point.
• detectedbySerial — Serial number of the access point that detected the threat.
• account — Account ID the incident is associated with.
• serial — Serial number of the access point that detected the threat.
• threatWirelessMac — The BSSID/MAC address of the malicious Access point.
• detectedbyName — Name of the access point that detected the threat.
• id — Incident ID.
• threatSecurity — The security type of the SSID broadcast by the malicious access point.
• threatProtocol — The wireless protocol used by the malicious access point, such as 802.11ac.
• distance — The estimated distance of the detected malicious access point measured in feet and meters.
• timestamp — The time at which the access point detected the threat.
• detectedbyMac — The MAC address of the access point that detected the threat.
• threatSsid — The SSID broadcast by the malicious access point.
• threatType — The type of the threat. This can be one of these values:
  • Evil Twin
  • Rogue AP
  • Suspected Rogue AP
• threatIp — The IP address of the malicious access point.
• threatBssid — The BSSID MAC address of the wireless interface of the malicious access point.
• threatReason — Indicates the reason why a device was classified as a malicious access point..

Endpoint

• malware — Name of the malware associated with the incident.
• file — Path of a local file on the computer associated with the incident.
• pid — ID of a process associated with an incident.
• md5 — MD5 hash of the file or process associated with an incident.

Firebox

• srcAddr — IP address that was the source of the traffic.
• srcPort — The TCP or UDP port number used to send traffic.
• srcInterface — Name of the interface that was the source of the traffic.
• dstAddr — Destination IP address.
• dstPort — The TCP or UDP port number used to receive traffic.
• dstInterface — Name of the interface that was the destination of the traffic.
• protocol — Protocol used for the connection, such as TCP.
• policy — Name of the Firebox policy associated with traffic.
• proxyAction — Name of the Firebox proxy action associated with the traffic.
• maliciousIp — IP address of the connection identified as malicious.
• connectionTime — Time stamp of the connection.

Firebox Threat Details by Category

AV (Antivirus)

• attachment — Name of an attachment contained in an email message (IMAP).
• filename — Name of a file contained in an email message (POP3).
• host — Host name of an HTTP request.
• mailbox — Name of a mailbox on a mail server (IMAP and SMTP).
• md5 — The MD5 hash of the content.
• path — URL path of an HTTP request.
• virus — Name of the virus detected.

IPS (Intrusion Prevention Service)

• host — Host name of an HTTP request.
• path — URL path of an HTTP request.
• signature — Name of the related IPS signature.

Malicious IP

• source — Contains the value "Botnet" if the incident is related to a botnet attack

Malicious URL

• maliciousUrl — The suspected malicious URL of an HTTP request.

Malware

• attachment — Name of an attachment contained in an email message (IMAP).
• filename — Name of a file contained in an email message (POP3).
• host — Host name of an HTTP request.
• mailbox — Name of a mailbox on a mail server (IMAP and SMTP).
• md5 — MD5 hash of the content.
• path — URL path of an HTTP request.
• recipients — Recipients of the email message (SMTP).
• sender — Sender of the email message (SMTP).

Example: "malware": "Demo.TestFile"

entityIds
string

The ID of the entity.

Example: 70513

status
string

Specifies the status of the incident. This can be one of these values:

• archived — Incidents archived by an automation policy or manually archived.
• new — New incidents not yet reviewed.
• viewed — Reviewed incidents or incidents marked as read.

Example: viewed

lastUpdateTime
string

The date and time (UTC) when the incident was last changed.

Example: 2023-07-21T05:31:41Z

updatedBy
string

The name of the operator that updated the incident status. Or system if the update was in response to an automated action.

Example: 6b857fba02a8c7ca_rw_id

comments
array

List of comments.

id
string

Unique identifier of a comment.

Example: 8577afb3e4cb45e5abc8c4a1d9b21199

incidentId
string

Unique identifier of an incident.

Example: cq7m4paoksm0rb2o46ag

user
string

The user name of the operator that initiated the comment request.

Example: xdradmin

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456 or ACC-1234567

comment
string

The comment added to the specified incident.

Example: Sample comment

creationTime
string

The time the comment was created.

Example: 2023-09-27T06:44:34Z

lastUpdateTime
string

The time the comment was last updated.

Example: 2023-09-27T06:44:34Z

command
string

Name of the action on the incident. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The Access Point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: blockAddress

actionId
string

Unique identifier of the action.

Example: 6a53f515f5994e0983df9e47444c1fc7

context
string

Specifies the context when the comment was added. This can be one of these values:

• action — Comment added when a new action was created.
• statusChange — Comment added when the status of the incident was updated.
  

Example: action

newStatus
string

The status of the incident. This can be one of these values:

• new — New incidents not yet reviewed.
• viewed — Reviewed incidents or incidents marked as read.
• archived — Incidents archived by an automation policy or manually archived.
  

Example: new

actions
array

Details for an action on an incident.

entityId
string

The ID of the entity.

Example: 70513

entityType
string

Type of entity. This can be one of these values:

• Access Point
• Endpoint
• Firebox

Example: firebox

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block
• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — One of these parameters required:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• isolate — No required parameters.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file.
• unblockAddress — Required parameters:
  • address — The IP address to unblock.
• unIsolate — No required parameters.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

irreversible
boolean

Indicates whether the action is irreversible. This can be one of two values:

• true
• false

Example: false

type
string

The type of action performed.

Example: manual

responder
string

The incident responder. This can be one of these values:

• Source — Action is taken by the endpoint.
• System — Action is initiated manually.
• ThreatSync — Action is initiated by an automation policy.

Example: System

creationTime
string

The time the action was created.

Example: 2023-09-08T17:39:18Z

command
string

Name of the action. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The access point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: isolate

lastUpdateTime
string

The date and time (UTC) when the action was last changed.

Example: 2023-07-21T05:31:41Z

initiatedBy
string

The user name of the operator that initiated the action.

Example: 6b337fba02a8c7ca_rw_id

count
integer

Total count of incidents.

Example: 1

startAfter
object

When you include the sortBy and limit parameters in the request, this parameter shows the data you can use to construct a request for the next page of results.

Example: {"threatsyncIncidents": { "timestamp": "2023-08-24T08:36:34Z" }}

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: c8p7nlhlgag91nihhiqg

includeActions
boolean

Specifies whether to include actions for an incident.

The default value is false.

Example: true

includeComments
boolean

Specifies whether to include comments for an incident.

The default value is false.

Example: true

id
string

ID of the incident.

Example: cihb9v9jp69d29pts8eg

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

category
string

Category of the incident. This can be one of these values:

• AV
• Exploit
• IPS
• IOA
• Malicious Access Point
• Malicious URL
• Malware
• Unknown Program

Example: exploit

type
string

Type of malware.

Example: VIRUS Eicar test string -1

timestamp
string

Date and time the incident was created.

Example: 2022-03-17T00:05:16Z

threatScore
integer

Threat score of the incident.

Example: 5

severity
string

The risk score category. This can be one of these values:

• Critical — Scores of 9 or 10
• High — Scores of 7 or 8
• Medium — Scores of 4, 5, or 6
• Low — Scores of 1, 2, or 3

Example: Medium

description
string

Description of the threat detected.

Example: Intrusion was detected by the Firebox IPS engine

remediated
boolean

Remediation status of the incident. This can be one of two values:

• true
• false

Example: false

entities
object

Details of the entity that the incident belongs to.

Example: type

id
string

Unique identifier for the entity.

Example: 14359

type
string

Type of entity.

Example: Endpoint

recommendedActions
array

List of recommended actions that can be performed on the incident.

command
string

Name of the recommended action to perform. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• isolate — Isolates an endpoint-protected computer.
• unIsolate — Unisolates an isolated computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.

Example: isolate

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block.
• unblockAddress — Required parameters:
  • address — The IP address to unblock.
• isolate — No required parameters.
• unIsolate — No required parameters.
• killProcess — One of these parameters required:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

actionPerformed
array

List of actions performed at the source (Firebox or Endpoint) in response to the threat.

command
string

Name of the action performed. This can be one of these values:

• blockConnection — The Firebox blocked a connection.
• blockProcess — The endpoint agent prevented a process from running.
• deleteFile — The endpoint agent deleted a file on the host computer.
• detected — The access point detected a threat.
• killProcess — The endpoint agent ended a running process on the host computer.

Example: deleteFile

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — Parameters can include
  • md5 — The MD5 hash associated with the process.

threatDetails
object

Threat details of an incident. The parameters depend on the type of threat and can include one or more of these values:

Access Point

• deviceId — The device ID of the access point that detected the threat.
• threatWiredMac — The MAC address of the wired interface of the Rogue access point.
• rssi — The RSSI (Received Signal Strength Indicator) of the malicious access point.
• agentIp — The IP address of the access point that detected the threat.
• band — The wireless band used by the Rogue access point, such as 2.4 GHz or 5 GHz.
• channel — The wireless channel used by the Rogue access point.
• detectedbySerial — Serial number of the access point that detected the threat.
• account — Account ID the incident is associated with.
• serial — Serial number of the access point that detected the threat.
• threatWirelessMac — The BSSID/MAC address of the malicious Access point.
• detectedbyName — Name of the access point that detected the threat.
• id — Incident ID.
• threatSecurity — The security type of the SSID broadcast by the malicious access point.
• threatProtocol — The wireless protocol used by the malicious access point, such as 802.11ac.
• distance — The estimated distance of the detected malicious access point measured in feet and meters.
• timestamp — The time at which the access point detected the threat.
• detectedbyMac — The MAC address of the access point that detected the threat.
• threatSsid — The SSID broadcast by the malicious access point.
• threatType — The type of the threat. This can be one of these values:
  • Evil Twin
  • Rogue AP
  • Suspected Rogue AP
• threatIp — The IP address of the malicious access point.
• threatBssid — The BSSID MAC address of the wireless interface of the malicious access point.
• threatReason — Indicates the reason why a device was classified as a malicious access point.

Endpoint

• malware — Name of the malware associated with the incident.
• file — Path of a local file on the computer associated with the incident.
• pid — ID of a process associated with an incident.
• md5 — MD5 hash of the file or process associated with an incident.

Firebox

• srcAddr — IP address that was the source of the traffic.
• srcPort — The TCP or UDP port number used to send traffic.
• srcInterface — Name of the interface that was the source of the traffic.
• dstAddr — Destination IP address.
• dstPort — The TCP or UDP port number used to receive traffic.
• dstInterface — Name of the interface that was the destination of the traffic.
• protocol — Protocol used for the connection, such as TCP.
• policy — Name of the Firebox policy associated with traffic.
• proxyAction — Name of the Firebox proxy action associated with the traffic.
• maliciousIp — IP address of the connection identified as malicious.
• connectionTime — Time stamp of the connection.

Firebox Threat Details by Category

AV (Antivirus)

• attachment — Name of an attachment contained in an email message (IMAP).
• filename — Name of a file contained in an email message (POP3).
• host — Host name of an HTTP request.
• mailbox — Name of a mailbox on a mail server (IMAP and SMTP).
• md5 — The MD5 hash of the content.
• path — URL path of an HTTP request.
• virus — Name of the virus detected.

IPS (Intrusion Prevention Service)

• host — Host name of an HTTP request.
• path — URL path of an HTTP request.
• signature — Name of the related IPS signature.

Malicious IP

• source — Contains the value "Botnet" if the incident is related to a botnet attack

Malicious URL

• maliciousUrl — The suspected malicious URL of an HTTP request.

Malware

• attachment — Name of an attachment contained in an email message (IMAP).
• filename — Name of a file contained in an email message (POP3).
• host — Host name of an HTTP request.
• mailbox — Name of a mailbox on a mail server (IMAP and SMTP).
• md5 — MD5 hash of the content.
• path — URL path of an HTTP request.
• recipients — Recipients of the email message (SMTP).
• sender — Sender of the email message (SMTP).

Example: "malware": "Demo.TestFile"

entityIds
string

The ID of the entity.

Example: 70513

status
string

Specifies the status of the incident. This can be one of these values:

• new — New incidents not yet reviewed.
• viewed — Reviewed incidents or incidents marked as read.
• archived — Incidents archived by an automation policy or manually archived.

Example: viewed

comments
array

List of comments.

id
string

Unique identifier of a comment.

Example: 8577afb3e4cb45e5abc8c4a1d9b21199

incidentId
string

Unique identifier of an incident.

Example: cq7m4paoksm0rb2o46ag

user
string

The user name of the operator that initiated the comment request.

Example: xdradmin

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456 or ACC-1234567

comment
string

The comment added to the specified incident.

Example: Sample comment

creationTime
string

The time the comment was created.

Example: 2023-09-27T06:44:34Z

lastUpdateTime
string

The time the comment was last updated.

Example: 2023-09-27T06:44:34Z

command
string

Name of the action on the incident. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The Access Point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: blockAddress

actionId
string

Unique identifier of the action.

Example: 6a53f515f5994e0983df9e47444c1fc7

context
string

Specifies the context when the comment was added. This can be one of these values:

• action — Comment added when a new action was created.
• statusChange — Comment added when the status of the incident was updated.
  

Example: action

newStatus
string

The status of the incident. This can be one of these values:

• new — New incidents not yet reviewed.
• viewed — Reviewed incidents or incidents marked as read.
• archived — Incidents archived by an automation policy or manually archived.
  

Example: new

actions
array

Details for an action on an incident.

entityId
string

The ID of the entity.

Example: 70513

entityType
string

Type of entity. This can be one of these values:

• Access Point
• Endpoint
• Firebox

Example: firebox

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block
• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — One of these parameters required:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• isolate — No required parameters.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file.
• unblockAddress — Required parameters:
  • address — The IP address to unblock.
• unIsolate — No required parameters.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

irreversible
boolean

Indicates whether the action is irreversible. This can be one of two values:

• true
• false

Example: false

type
string

The type of action performed.

Example: manual

responder
string

The incident responder. This can be one of these values:

• Source — Action is taken by the endpoint.
• System — Action is initiated manually.
• ThreatSync — Action is initiated by an automation policy.

Example: System

creationTime
string

The time the action was created.

Example: 2023-09-08T17:39:18Z

command
string

Name of the action. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The access point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: isolate

lastUpdateTime
string

The date and time (UTC) when the action was last changed.

Example: 2023-07-21T05:31:41Z

initiatedBy
string

The user name of the operator that initiated the action.

Example: 6b337fba02a8c7ca_rw_id

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: c8p7nlhlgag91nihhiqg

status
string
REQUIRED

Updated incident status. Specify one of these values:

• archived — Incidents archived by an automation policy or manual action.
• new — New incidents not yet reviewed.
• viewed — Reviewed incidents or incidents marked as read.

comment
string

Optional. Specifies a comment to add for the incident.

Example: Sample comment

id
string

Unique identifier of the incident record.

Example: cjo38rng0qbgs12ehiqg

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

category
string

Category of the incident. This can be one of these values:

• AV
• Exploit
• IPS
• IOA
• Malicious Access Point
• Malicious URL
• Malware
• Unknown Program

Example: ips

type
string

Type of malware.

Example: VIRUS Eicar test string -1

timestamp
string

Date and time the incident was created.

Example: 2022-03-17T00:05:16Z

threatScore
integer

Threat score of the incident.

Example: 5

severity
string

The risk score category. This can be one of these values:

• Critical — Scores of 9 or 10
• High — Scores of 7 or 8
• Medium — Scores of 4, 5, or 6
• Low — Scores of 1, 2, or 3

Example: Medium

description
string

Description of the threat detected.

Example: Intrusion was detected by the Firebox IPS engine

remediated
boolean

Remediation status of the incident. This can be one of two values:

• true
• false

Example: false

entities
object

Details of the entity that the incident belongs to.

Example: type

id
string

Unique identifier for the entity.

Example: 14359

type
string

Type of entity.

Example: Endpoint

recommendedActions
array

List of recommended actions that can be performed on the incident.

command
string

Name of the recommended action to perform. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• isolate — Isolates an endpoint-protected computer.
• unIsolate — Unisolates an isolated computer.
• killProcess — Ends a process on an endpoint-protected computer
• quarantineFile — Quarantines a file on an endpoint-protected computer.

Example: isolate

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block.
• unblockAddress — Required parameters:
  • address — The IP address to unblock.
• isolate — No required parameters.
• unIsolate — No required parameters.
• killProcess — One of these parameters required:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

actionPerformed
array

List of actions performed at the source (Firebox or Endpoint) in response to the threat.

command
string

Name of the action performed. This can be one of these values:

• blockConnection — The Firebox blocked a connection.
• blockProcess — The endpoint agent prevented a process from running.
• deleteFile — The endpoint agent deleted a file on the host computer.
• detected — The access point detected a threat.
• killProcess — The endpoint agent ended a running process on the host computer.

Example: deleteFile

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — Parameters can include
  • md5 — The MD5 hash associated with the process.

threatDetails
object

Threat details of an incident. The parameters depend on the type of threat and can be one or more of these values:

Access Point

• deviceId — The device ID of the access point that detected the threat.
• threatWiredMac — The MAC address of the wired interface of the Rogue access point.
• rssi — The RSSI (Received Signal Strength Indicator) of the malicious access point.
• agentIp — The IP address of the access point that detected the threat.
• band — The wireless band used by the Rogue access point, such as 2.4 GHz or 5 GHz.
• channel — The wireless channel used by the Rogue access point.
• detectedbySerial — Serial number of the access point that detected the threat.
• account — Account ID the incident is associated with.
• serial — Serial number of the access point that detected the threat.
• threatWirelessMac — The BSSID/MAC address of the malicious Access point.
• detectedbyName — Name of the access point that detected the threat.
• id — Incident ID.
• threatSecurity — The security type of the SSID broadcast by the malicious access point.
• threatProtocol — The wireless protocol used by the malicious access point, such as 802.11ac.
• distance — The estimated distance of the detected malicious access point measured in feet and meters.
• timestamp — The time at which the access point detected the threat.
• detectedbyMac — The MAC address of the access point that detected the threat.
• threatSsid — The SSID broadcast by the malicious access point.
• threatType — The type of the threat. This can be one of these values:
  • Evil Twin
  • Rogue AP
  • Suspected Rogue AP
• threatIp — The IP address of the malicious access point.
• threatBssid — The BSSID MAC address of the wireless interface of the malicious access point.
• threatReason — Indicates the reason why a device was classified as a malicious access point.

Endpoint

• malware — Name of the malware associated with the incident.
• file — Path of a local file on the computer associated with the incident.
• pid — ID of a process associated with an incident.
• md5 — MD5 hash of the file or process associated with an incident.

Firebox

• srcAddr — IP address that was the source of the traffic.
• srcPort — The TCP or UDP port number used to send traffic.
• srcInterface — Name of the interface that was the source of the traffic.
• dstAddr — Destination IP address.
• dstPort — The TCP or UDP port number used to receive traffic.
• dstInterface — Name of the interface that was the destination of the traffic.
• protocol — Protocol used for the connection, such as TCP.
• policy — Name of the Firebox policy associated with traffic.
• proxyAction — Name of the Firebox proxy action associated with the traffic.
• maliciousIp — IP address of the connection identified as malicious.
• connectionTime — Time stamp of the connection.

Firebox Threat Details by Category

AV (Antivirus)

• attachment — Name of an attachment contained in an email message (IMAP).
• filename — Name of a file contained in an email message (POP3).
• host — Host name of an HTTP request.
• mailbox — Name of a mailbox on a mail server (IMAP and SMTP).
• md5 — The MD5 hash of the content.
• path — URL path of an HTTP request.
• virus — Name of the virus detected.

IPS (Intrusion Prevention Service)

• host — Host name of an HTTP request.
• path — URL path of an HTTP request.
• signature — Name of the related IPS signature.

Malicious IP

• source — Contains the value "Botnet" if the incident is related to a botnet attack

Malicious URL

• maliciousUrl — The suspected malicious URL of an HTTP request.

Malware

• attachment — Name of an attachment contained in an email message (IMAP).
• filename — Name of a file contained in an email message (POP3).
• host — Host name of an HTTP request.
• mailbox — Name of a mailbox on a mail server (IMAP and SMTP).
• md5 — MD5 hash of the content.
• path — URL path of an HTTP request.
• recipients — Recipients of the email message (SMTP).
• sender — Sender of the email message (SMTP).

Example: "malware": "Demo.TestFile"

entityIds
string

The ID of the entity.

Example: 70513

status
string

Specifies the status of the incident. This can be one of these values:

• archived — Incidents archived by an automation policy or manually archived.
• new — New incidents not yet reviewed.
• viewed — Reviewed incidents or incidents marked as read.

Example: viewed

lastUpdateTime
string

The date and time (UTC) when the incident was last changed.

Example: 2023-07-21T05:31:41Z

updatedBy
string

The name of the operator that updated the incident status. Or system if the update was in response to an automated action.

Example: 6b857fba02a8c7ca_rw_id

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: c8p7nlhlgag91nihhiqg

query
string

Query string that enables you to search for records that match the specified data. Specify response parameter names and associated values to retrieve objects that match those values.

Examples:

threatScore:>5 && status:viewed

category:malicious_url OR category:IPS OR category:IOA

status:performed OR status:inProgress

For more information about how to construct query strings, go to the Apache Lucene documentation.

sortBy
string

Specifies how to sort results. This can be the names of one or more response parameters, separated by commas.

Example: threatScore

sortOrder
string

Specifies whether to sort the results in ascending or descending order. This can be one of these values:

• asc — Sort results in ascending order
• desc — Sort results in descending order

If you do not specify a value, the API returns results in ascending order.

Example: desc

groupBy
string

Specifies the response parameter to group data by.

Example: status

fields
string

Specifies which response parameters to return in the results. If you do not specify a value, the API returns all response parameters.

Example : id,summary,timestamp

countOnly
boolean

Specifies whether to retrieve only a count of records.

Example: true

limit
integer

Maximum number of records to retrieve in the response. The maximum is limited to 1000 records.

Example: 50

startAfter
string

Cursor value that identifies the record after which you want to retrieve records. This value must match the data returned in the response parameter you specify in the sortBy request parameter.

Example: 2023-02-12T23:05:28

duration
string

Duration of time in days to retrieve records for. Specify a number followed by the letter D.

Example: 10D

items
array

Array of actions.

id
string

The ID of an action.

Example: 94ea663ee6094a6fbbe71107f4c4c46f

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

incidentId
string

The ID of an incident.

Example: cjdk66vhk6vdk94iliog

entityId
string

The ID of the entity.

Example: 70513

entityType
string

Type of entity. This can be one of these values:

• Access Point
• Endpoint
• Firebox

Example: firebox

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block
• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — One of these parameters required:
  • pid — The process ID
  • md5 — The md5 hash of the file
• isolate — No required parameters.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file
• unblockAddress — Required parameters:
  • address — The IP address to unblock
• unIsolate — No required parameters.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

irreversible
boolean

Indicates whether the action is irreversible. This can be one of two values:

• true
• false

Example: false

type
string

The type of action performed.

Example: manual

errorMessage
string

Error message from the action.

Example: Unexpected error

responder
string

The incident responder. This can be one of these values:

• Source — Action is taken by the endpoint.
• System — Action is initiated manually.
• ThreatSync — Action is initiated by an automation policy.

Example: System

creationTime
string

The date and time the item was created.

Example: 2023-09-08T17:39:18Z

command
string

Name of the action. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The access point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: isolate

status
string

The status of the action.

Example: inProgress

lastUpdateTime
string

The date and time (UTC) when the incident status was last changed.

Example: 2023-07-21T05:31:41Z

initiatedBy
string

The user name of the operator that initiated the action.

Example: j-castro

history
string

Historical details of the action performed on the incident.

Example: lastUpdateTime

result
string

The result of the action.

Example: {"status": "performed"}

count
integer

Total count of actions.

Example: 1

startAfter
object

When you include the sortBy and limit parameters in the request, this parameter shows the data you can use to construct a request for the next page of results.

Example: {"threatsyncActions": { "entityId": "70512" }}

Example: 1

accountId

string

REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: c8p7nlhlgag91nihhiqg

command
string
REQUIRED

Specifies the action to perform. This can be one of these actions:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• killProcess — Ends a process on an endpoint-protected computer.
• isolate — Isolates an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: blockAddress

parameters
object
REQUIRED

Parameters required to perform the action. These depend on the action you specify in the command parameter:

• blockAddress — Specify these required parameters:
  • address — The IP address to block.
• isolate — No required parameters.
• killProcess — Specify one these required parameters:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• quarantineFile — Specify these required parameters:
  • md5 — The md5 hash of the file.
• unIsolate — No required parameters.
• unblockAddress — Specify these required parameters:
  • address — The IP address to unblock.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

entityId
string

The ID of the entity to perform the action on.

This request parameter is required for endpoint actions and optional for Firebox actions.

Example: 70513

comment
string

Specifies a comment to add for an action.

Example: Sample comment

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: cjjbnnnhk6vdk95da4kg

actionId
string
REQUIRED

The ID of an action.

Example: fc68d5d946e747a991a1e4388bbf7ef6

id
string

Unique identifier of the action.

Example: cjo38rng0qbgs12ehiqg

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

incidentId
string

The ID of an incident.

Example: c8p7nlhlgag91nihhiqg

entityId
string

The ID of the entity.

Example: 70513

entityType
string

Type of entity. This can be one of these values:

• Access Point
• Endpoint
• Firebox

Example: firebox

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block
• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — One of these parameters required:
  • pid — The process ID
  • md5 — The md5 hash of the file
• isolate — No required parameters.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file
• unblockAddress — Required parameters:
  • address — The IP address to unblock
• unIsolate — No required parameters.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

irreversible
boolean

Indicates whether the action is irreversible. This can be one of two values:

• true
• false

Example: false

type
string

The type of action performed.

Example: manual

errorMessage
string

Error message from the action.

Example: Unexpected error

responder
string

The incident responder. This can be one of these values:

• Source - Action is taken by the endpoint
• System — Action is initiated manually
• ThreatSync — Action is initiated by an automation policy

Example: System

creationTime
string

The time the item was created.

Example: 2023-09-08T17:39:18Z

command
string

Name of the action. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The access point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: isolate

status
string

Status of the action.

Example: performed

lastUpdateTime
string

The date and time (UTC) when the incident was last changed.

Example: 2023-07-21T05:31:41Z

initiatedBy
string

The user name of the operator that initiated the action.

Example: s-nguyen-owner

history
string

Historical details of the action performed on the incident.

Example: {"lastUpdateTime": "2023-08-24T09:51:59Z", "status": "performed"}

result
string

The result of the action.

Example: {"status": "performed"}

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

query
string

Query string that enables you to search for records that match the specified data. Specify response parameter names and associated values to retrieve objects that match those values.

Examples:

threatScore:>5 && status:viewed

category:malicious_url OR category:IPS OR category:IOA

status:performed OR status:inProgress

For more information about how to construct query strings, go to the Apache Lucene documentation.

sortBy
string

Specifies how to sort results. This can be the names of one or more response parameters, separated by commas.

Example: threatScore

sortOrder
string

Specifies whether to sort the results in ascending or descending order. This can be one of these values:

• asc — Sort results in ascending order
• desc — Sort results in descending order

If you do not specify a value, the API returns results in ascending order.

Example: desc

groupBy
string

Specifies the parameter to group data by.

Example: status

fields
string

Specifies which response parameters to return in the results. If you do not specify a value, the API returns all response parameters.

Example : id,summary,timestamp

countOnly
boolean

Specifies whether to retrieve only a count of records.

Example: true

limit
integer

Maximum number of records to retrieve in the response. The maximum is limited to 1000 records.

Example: 50

startAfter
string

Cursor value that identifies the record after which you want to retrieve records. This value must match the data returned in the response parameter you specify in the sortBy request parameter.

Example: 2023-02-12T23:05:28

duration
string

Duration of time in days to retrieve records for. Specify a number followed by the letter D.

Example: 10D

items
array

List of actions.

id
string

Unique identifier of the action.

Example: cjo38rng0qbgs12ehiqg

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

incidentId
string

The ID of an incident.

Example: cjnatpvg0qbgs12c6t0g

entityId
string

The ID of the entity.

Example: 70513

entityType
string

Type of entity. This can be one of these values:

• Access Point
• Endpoint
• Firebox

Example: firebox

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Required parameters:
  • address — The IP address to block
• blockConnection — Parameters can include:
  • srcAddr — The connection source address.
  • srcPort — The connection source port.
  • dstAddr — The connection destination address.
  • dstPort — The connection destination address.
• blockProcess — Parameters can include:
  • md5 — The MD5 hash associated with the process.
• deleteFile — Parameters can include:
  • md5 — The MD5 hash of the deleted file.
• killProcess — One of these parameters required:
  • pid — The process ID
  • md5 — The md5 hash of the file
• isolate — No required parameters.
• quarantineFile — Required parameters:
  • md5 — The md5 hash of the file
• unblockAddress — Required parameters:
  • address — The IP address to unblock
• unIsolate — No required parameters.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

irreversible
boolean

Indicates whether the action is irreversible. This can be one of two values:

• true
• false

Example: false

type
string

The type of action performed.

Example: manual

errorMessage
string

Error message from the action.

Example: Unexpected error

responder
string

The incident responder. This can be one of these values:

• Source — Action is taken by the endpoint.
• System — Action is initiated manually.
• ThreatSync — Action is initiated by an automation policy.

Example: System

creationTime
string

The time the item was created.

Example: 2023-09-08T17:39:18Z

command
string

Name of the action. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The Access Point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: isolate

status
string

Status of the action.

Example: inProgress

lastUpdateTime
string

The date and time (UTC) when the incident was last changed.

Example: 2023-07-21T05:31:41Z

initiatedBy
string

The user name of the operator that initiated the action.

Example: 6b337fba02a8c7ca_rw_id

history
string

Historical details of the action performed on the incident.

Example: {"lastUpdateTime": "2023-08-24T09:51:59Z", "status": "performed"}

result
string

The result of the action.

Example: {"status": "performed"}

count
integer

Total count of actions.

Example: 1

startAfter
object

When you include the sortBy and limit parameters in the request, this parameter shows the data you can use to construct a request for the next page of results.

Example: {"threatsyncActions": { "entityId": "70512" }}

Example: 1

accountId

string

REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

command
string
REQUIRED

Specify one of these actions:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• isolate — Isolates an endpoint-protected computer.
• unIsolate — Unisolates an isolated computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.

Example: isolate

parameters
object
REQUIRED

Parameters required to perform the action. These depend on the action you specify in the command parameter:

• blockAddress — Specify these required parameters:
  • address — The IP address to block.
• unblockAddress — Specify these required parameters:
  • address — The IP address to unblock.
• isolate — No required parameters.
• unIsolate — No required parameters.
• killProcess — Specify one these required parameters:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• quarantineFile — Specify these required parameters:
  • md5 — The md5 hash of the file.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

entityId
string

The ID of the entity to perform the action on.

This request parameter is required for endpoint actions, and optional for Firebox actions.

Example: 70513

id
string

Unique identifier of the action.

Example: 14e35fa04e4a4b40bde636d3166da58c

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456

incidentId
string

The ID of an incident.

Example: cjnatpvg0qbgs12c6t0g

entityId
string

The ID of the entity.

Example: 70513

entityType
string

Type of entity. This can be one of two values:

• Endpoint
• Firebox

Example: firebox

parameters
object

Parameters required to perform the action. These depend on the action specified in the command parameter:

• blockAddress — Specify these required parameters:
  • address — The IP address to block.
• unblockAddress — Specify these required parameters:
  • address — The IP address to unblock.
• isolate — No required parameters.
• unIsolate — No required parameters.
• killProcess — Specify one these required parameters:
  • pid — The process ID.
  • md5 — The md5 hash of the file.
• quarantineFile — Specify these required parameters:
  • md5 — The md5 hash of the file.

Example: {"md5": "599951C2CCD2FD0C2E3181392712ECBA"}

irreversible
boolean

Indicates whether the action is irreversible. This can be one of two values:

• true
• false

Example: false

type
string

The type of action performed.

Example: manual

errorMessage
string

Error message from the action.

Example: Unexpected error

responder
string

The incident responder. This can be one of these values:

• Source - Action is taken by the endpoint
• System — Action is initiated manually
• ThreatSync — Action is initiated by an automation policy

Example: System

creationTime
string

The time the item was created.

Example: 2023-09-08T17:39:18Z

command
string

Name of the command required to perform the action. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• isolate — Isolates an endpoint-protected computer.
• unIsolate — Unisolates an isolated computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.

Example: isolate

status
string

Status of the action.

Example: inProgress

lastUpdateTime
string

The date and time (UTC) when the incident was last changed.

Example: 2023-07-21T05:31:41Z

initiatedBy
string

The user name of the operator that initiated the action.

Example: 6b337fba02a8c7ca_rw_id

history
string

Historical details of the action performed on the incident.

Example: {"lastUpdateTime": "2023-08-24T09:51:59Z", "status": "performed"}

path
string
REQUIRED

Path of the API endpoint to submit the request to.

Example: /v1/WGC-1-123abc456/incidents/cisi7nngkpcu8rsn5h20/actions

method
string
REQUIRED

HTTP method of the request.

Example: POST

data
object
REQUIRED

Request body to include with the request.

The data you must include depends on the API endpoint you specify in the path parameter. For detailed information, refer to the Example Request section for the endpoint.

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: cg0f0s2h7skomt847f1g

sortOrder
string

Specifies whether to sort the results in ascending or descending order. This can be one of these values:

• asc — Sort results in ascending order
• desc — Sort results in descending order

If you do not specify a value, the API returns results in ascending order.

Example: desc

sortBy
string

Specifies how to sort results. This can be the names of one or more response parameters, separated by commas.

Example: creationTime,id

groupBy
string

Specifies the response parameter to group data by. You can group the data by id, account, incidentId, actionId, user, comment, creationTime, lastUpdateTime, context, or newStatus.

Example: id

fields
string

Specifies which response parameters to return in the results. If you do not specify a value, the API returns all response parameters.

Example: id,account,incidentId,actionId,user,comment,creationTime,command,lastUpdateTime,context,newStatus

limit
integer

Maximum number of records to retrieve in the response. The maximum limit is 1000 records.

Example: 50

duration
string

Duration of time in days to retrieve records for. Specify a number followed by the letter D.

Example: 10D

startAfter
string

Cursor value that identifies the record after which you want to retrieve records. This value must match the data returned in the response parameter you specify in the sortBy request parameter.

Example: 2023-02-12T23:05:28

items
array

Array of incident comments.

id
string

Unique identifier of a comment.

Example: 903b824302b4419cac6ac4b0ead6719d

incidentId
string

Unique identifier of an incident.

Example: cq7m4paoksm0rb2o46ag

user
string

The user name of the operator that added the comment.

Example: xdradmin

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456 or ACC-1234567

comment
string

The comment added to the specified incident.

Example: Sample comment

creationTime
string

The time the comment was created.

Example: 2023-09-27T06:44:34Z

lastUpdateTime
string

The time the comment was last updated.

Example: 2023-09-27T06:44:34Z

command
string

Name of the action performed on the incident. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The Access Point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: blockAddress

actionId
string

Unique identifier of the action.

Example: 6a53f515f5994e0983df9e47444c1fc7

context
string

Specifies the context when the comment was added. This can be one of these values:

• action — Comment added when a new action was created.
• statusChange — Comment added when the status of the incident was updated.

Example: action

newStatus
string

The status of the incident. This can be one of these values:

• new - New incidents not yet reviewed.
• viewed - Reviewed incidents or incidents marked as read.
• archived - Incidents archived by an automation policy or manually archived.
  

Example: new

count
integer

Total count of comments.

Example: 1

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: cg0f0s2h7skomt847f1g

comment
string
REQUIRED

Comment for an incident.

Example: Sample comment

items
array

Array of incident items.

id
string

Unique identifier of a comment.

Example: 903b824302b4419cac6ac4b0ead6719dcjo38rng0qbgs12ehiqg

incidentId
string

Unique identifier of an incident.

Example: cq7m4paoksm0rb2o46ag

user
string

The user name of the operator that initiated the comment request.

Example: xdradmin

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456 or ACC-1234567

comment
string

The comment added to the specified incident.

Example: Sample comment

creationTime
string

The time the comment was created.

Example: 2023-09-27T06:44:34Z

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: cg0f0s2h7skomt847f1g

commentId
string
REQUIRED

The ID of a comment.

Example: 6026c9e0e7fb44a39bd3ee540e37ef41

comment
string
REQUIRED

Updated comment for an incident.

Example: updated comment

items
array

Array of incident items.

id
string

Unique identifier of a comment.

Example: 903b824302b4419cac6ac4b0ead6719dcjo38rng0qbgs12ehiqg

incidentId
string

Unique identifier of an incident.

Example: cq7m4paoksm0rb2o46ag

user
string

The user name of the operator that initiated the comment request.

Example: xdradmin

account
string

Account ID the incident is associated with.

Example: WGC-1-123abc456 or ACC-1234567

comment
string

The comment added to the specified incident.

Example: Sample comment

creationTime
string

The time the comment was created.

Example: 2023-09-27T06:44:34Z

lastUpdateTime
string

The time the comment was last updated.

Example: 2023-09-27T06:44:34Z

command
string

Name of the action on the incident. This can be one of these values:

• blockAddress — Adds an IP address to the Blocked Sites list of the account.
• blockConnection — The Firebox blocks a connection.
• blockProcess — The endpoint agent prevents a process from running.
• deleteFile — The endpoint agent deletes a file on the host computer.
• detected — The Access Point detects a threat.
• isolate — Isolates an endpoint-protected computer.
• killProcess — Ends a process on an endpoint-protected computer.
• quarantineFile — Quarantines a file on an endpoint-protected computer.
• unblockAddress — Removes an IP address from the Blocked Sites list of the account.
• unIsolate — Unisolates an isolated computer.

Example: blockAddress

actionId
string

Unique identifier of the action.

Example: 6a53f515f5994e0983df9e47444c1fc7

context
string

Context type whether an incident status is updated or a new action is created. The possible values are action and statusChange.

Example: action

newStatus
string

The status of the incident. This can be one of these values:

• new - New incidents not yet reviewed.
• viewed - Reviewed incidents or incidents marked as read.
• archived - Incidents archived by an automation policy or manually archived.
  

Example: new

accountId
string
REQUIRED

Your WatchGuard Cloud account ID, as shown on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

incidentId
string
REQUIRED

The ID of an incident.

Example: cg0f0s2h7skomt847f1g

commentId
string
REQUIRED

The ID of a comment.

Example: 6026c9e0e7fb44a39bd3ee540e37ef41