curl --request GET \
--url https://api.leen.dev/v1/edr/alerts/{alert_id} \
--header 'X-API-KEY: <api-key>' \
--header 'X-CONNECTION-ID: <api-key>'import requests
url = "https://api.leen.dev/v1/edr/alerts/{alert_id}"
headers = {
"X-API-KEY": "<api-key>",
"X-CONNECTION-ID": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {
method: 'GET',
headers: {'X-API-KEY': '<api-key>', 'X-CONNECTION-ID': '<api-key>'}
};
fetch('https://api.leen.dev/v1/edr/alerts/{alert_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.leen.dev/v1/edr/alerts/{alert_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>",
"X-CONNECTION-ID: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.leen.dev/v1/edr/alerts/{alert_id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-KEY", "<api-key>")
req.Header.Add("X-CONNECTION-ID", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.leen.dev/v1/edr/alerts/{alert_id}")
.header("X-API-KEY", "<api-key>")
.header("X-CONNECTION-ID", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.leen.dev/v1/edr/alerts/{alert_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'
request["X-CONNECTION-ID"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"active_directory_domain": "<string>",
"active_directory_user_id": "<string>",
"assigned_user": "<string>",
"description": "<string>",
"device": {
"ad_info": {
"device_id": "<string>",
"domain": "<string>",
"org_unit": "<string>",
"site_name": "<string>"
},
"first_seen": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"installed_software": [
"<string>"
],
"last_seen": "2023-11-07T05:31:56Z",
"source_vendors": [
{
"vendor": "<string>",
"vendor_id": "<string>",
"agent_info": {
"agent_version": "<string>",
"policies": [
{}
],
"signature_version": "<string>"
}
}
],
"status": "active",
"cloud_metadata": {
"account_id": "<string>",
"availability_zone": "<string>",
"cloud_provider": "aws",
"image_id": "<string>",
"instance_id": "<string>",
"instance_type": "<string>",
"kernel_id": "<string>",
"region": "<string>",
"subnet_id": "<string>",
"vpc_id": "<string>"
},
"fqdns": [
"<string>"
],
"hostnames": [
"<string>"
],
"identities": [
{
"username": "<string>",
"user_sid": "<string>"
}
],
"ipv4s": [
"<string>"
],
"ipv6s": [
"<string>"
],
"mac_addresses": [
"<string>"
],
"os_major_version": "<string>",
"os_minor_version": "<string>",
"os_version": "<string>",
"platform": "mac",
"tags": [
{
"key": "<string>",
"source": "aws",
"value": "<string>"
}
],
"vendor_data": {}
},
"first_event_time": "2023-11-07T05:31:56Z",
"last_event_time": "2023-11-07T05:31:56Z",
"mitre": [
{
"techniques": [
{
"technique_id": "<string>",
"technique_link": "<string>",
"technique_name": "<string>"
}
],
"tactic_id": "<string>",
"tactic_name": "<string>",
"tactic_source": "<string>"
}
],
"parent_pid": "<string>",
"pid": "<string>",
"process_command_line": "<string>",
"process_created_at": "2023-11-07T05:31:56Z",
"process_filename": "<string>",
"process_filepath": "<string>",
"process_md5": "<string>",
"process_sha1": "<string>",
"process_sha256": "<string>",
"resolved_time": "2023-11-07T05:31:56Z",
"title": "<string>",
"user_name": "<string>",
"vendor": "crowdstrike",
"vendor_id": "<string>",
"vendor_severity": "<string>",
"vendor_status": "<string>",
"verdict": "FALSE_POSITIVE",
"windows_sid": "<string>",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"observables": [
{
"name": "<string>",
"type_id": 0,
"type": "UNKNOWN",
"value": "<string>"
}
],
"severity": "none",
"status": "unknown",
"vendor_data": {
"aggregate_id": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"falcon_host_link": "<string>",
"updated_at": "2023-11-07T05:31:56Z",
"vendor": "CROWDSTRIKE"
}
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"ctx": {},
"input": "<unknown>"
}
]
}Get Alert by ID
Retrieve an EDR alert by its ID (Leen’s UUID).
curl --request GET \
--url https://api.leen.dev/v1/edr/alerts/{alert_id} \
--header 'X-API-KEY: <api-key>' \
--header 'X-CONNECTION-ID: <api-key>'import requests
url = "https://api.leen.dev/v1/edr/alerts/{alert_id}"
headers = {
"X-API-KEY": "<api-key>",
"X-CONNECTION-ID": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {
method: 'GET',
headers: {'X-API-KEY': '<api-key>', 'X-CONNECTION-ID': '<api-key>'}
};
fetch('https://api.leen.dev/v1/edr/alerts/{alert_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.leen.dev/v1/edr/alerts/{alert_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>",
"X-CONNECTION-ID: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.leen.dev/v1/edr/alerts/{alert_id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-KEY", "<api-key>")
req.Header.Add("X-CONNECTION-ID", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.leen.dev/v1/edr/alerts/{alert_id}")
.header("X-API-KEY", "<api-key>")
.header("X-CONNECTION-ID", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.leen.dev/v1/edr/alerts/{alert_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'
request["X-CONNECTION-ID"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"active_directory_domain": "<string>",
"active_directory_user_id": "<string>",
"assigned_user": "<string>",
"description": "<string>",
"device": {
"ad_info": {
"device_id": "<string>",
"domain": "<string>",
"org_unit": "<string>",
"site_name": "<string>"
},
"first_seen": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"installed_software": [
"<string>"
],
"last_seen": "2023-11-07T05:31:56Z",
"source_vendors": [
{
"vendor": "<string>",
"vendor_id": "<string>",
"agent_info": {
"agent_version": "<string>",
"policies": [
{}
],
"signature_version": "<string>"
}
}
],
"status": "active",
"cloud_metadata": {
"account_id": "<string>",
"availability_zone": "<string>",
"cloud_provider": "aws",
"image_id": "<string>",
"instance_id": "<string>",
"instance_type": "<string>",
"kernel_id": "<string>",
"region": "<string>",
"subnet_id": "<string>",
"vpc_id": "<string>"
},
"fqdns": [
"<string>"
],
"hostnames": [
"<string>"
],
"identities": [
{
"username": "<string>",
"user_sid": "<string>"
}
],
"ipv4s": [
"<string>"
],
"ipv6s": [
"<string>"
],
"mac_addresses": [
"<string>"
],
"os_major_version": "<string>",
"os_minor_version": "<string>",
"os_version": "<string>",
"platform": "mac",
"tags": [
{
"key": "<string>",
"source": "aws",
"value": "<string>"
}
],
"vendor_data": {}
},
"first_event_time": "2023-11-07T05:31:56Z",
"last_event_time": "2023-11-07T05:31:56Z",
"mitre": [
{
"techniques": [
{
"technique_id": "<string>",
"technique_link": "<string>",
"technique_name": "<string>"
}
],
"tactic_id": "<string>",
"tactic_name": "<string>",
"tactic_source": "<string>"
}
],
"parent_pid": "<string>",
"pid": "<string>",
"process_command_line": "<string>",
"process_created_at": "2023-11-07T05:31:56Z",
"process_filename": "<string>",
"process_filepath": "<string>",
"process_md5": "<string>",
"process_sha1": "<string>",
"process_sha256": "<string>",
"resolved_time": "2023-11-07T05:31:56Z",
"title": "<string>",
"user_name": "<string>",
"vendor": "crowdstrike",
"vendor_id": "<string>",
"vendor_severity": "<string>",
"vendor_status": "<string>",
"verdict": "FALSE_POSITIVE",
"windows_sid": "<string>",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"observables": [
{
"name": "<string>",
"type_id": 0,
"type": "UNKNOWN",
"value": "<string>"
}
],
"severity": "none",
"status": "unknown",
"vendor_data": {
"aggregate_id": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"falcon_host_link": "<string>",
"updated_at": "2023-11-07T05:31:56Z",
"vendor": "CROWDSTRIKE"
}
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"ctx": {},
"input": "<unknown>"
}
]
}Path Parameters
Response
Successful Response
Active Directory domain
Active Directory user ID
Assigned user
Description of alert, provided by the upstream vendor
Device attached to the alert, include device groups with includeDeviceGroups query parameter
- Device
- DeviceWithGroups
Show child attributes
Show child attributes
First event time
Last event time
MITRE Tactics associated with the alert
Show child attributes
Show child attributes
Parent process ID
Process ID
Process command line
Process created at
Process filename
Process filepath
Process MD5
Process SHA1
Process SHA256
Resolved time
Title of the alert, provided by the upstream vendor
User name
Source vendor
crowdstrike, ms_defender_endpoint, sentinelone Vendor's ID of the alert
Vendor's severity
Vendor's status
Analyst verdict
FALSE_POSITIVE, TRUE_POSITIVE, SUSPICIOUS, IGNORED, UNKNOWN Windows SID
Leen's identifier for this alert.
Observable data associated with the alert
Show child attributes
Show child attributes
Alert severity
none, low, medium, high, critical, info Alert status
unknown, new, in_progress, unresolved, resolved Vendor specific pass through data, values can vary based on vendor
- CrowdStrikeEDRVendorData
- MSDefenderEDRVendorData
- SentinelOneEDRVendorData
Show child attributes
Show child attributes