Vendor specific pass through data, values can vary based on vendor
CrowdStrikeEDRVendorData
MSDefenderEDRVendorData
SentinelOneEDRVendorData
Show child attributes
{"docsConfig":{"$schema":"https://mintlify.com/docs.json","theme":"mint","name":"Leen.dev Unified API for Security","colors":{"primary":"#8C43EA","light":"#B5FF56","dark":"#8C43EA"},"favicon":"https://mintcdn.com/leen/vQ2Rhs44KY1LGMJC/favicon.png?fit=max\u0026auto=format\u0026n=vQ2Rhs44KY1LGMJC\u0026q=85\u0026s=00c30a06bc8cf54ffc2eaafd1c8a90d5","logo":{"light":"https://mintcdn.com/leen/0MpnNXrQ3mRuduqT/logo/light.svg?fit=max\u0026auto=format\u0026n=0MpnNXrQ3mRuduqT\u0026q=85\u0026s=f622048d909cda879d6dc25b3331a9a8","dark":"https://mintcdn.com/leen/0MpnNXrQ3mRuduqT/logo/dark.svg?fit=max\u0026auto=format\u0026n=0MpnNXrQ3mRuduqT\u0026q=85\u0026s=53e1f792b0c80b645b1350397e708e18"},"api":{"openapi":["openapi.json","openapi_v2.json"]},"appearance":{"default":"light","strict":false},"background":{"decoration":null,"color":{"light":"#F6F5EF","dark":"#090d0e"}},"navbar":{"links":[{"label":"Support","href":"mailto:contact@leen.dev"}],"primary":null},"integrations":{"ga4":{"measurementId":"G-0RXD479LK7"}},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"leen","hasAudioNarration":false,"actualSubdomain":"leen","customDomains":["docs.leen.dev"],"gitSource":{"type":"github","owner":"leeninc","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":false,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ae0b2830b083cd94624604d","collectionId":"e851f5a8-ffd6-45a3-ae99-ed44311df306","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ae0b2830b083cd94624604d"},"entitlements":{},"buildId":"6ae0b2830b083cd94624604d","clientVersion":"0.0.4044","searchFilterCounts":[{"language":"default","tag":"API Reference","count":91},{"language":"default","tag":"Documentation","count":64},{"language":"default","tag":"Integrations","count":54},{"language":"default","tag":"Setup Instructions","count":36},{"language":"default","tag":"ITSM","count":23},{"language":"default","tag":"Identity Provider (IDP)","count":13},{"language":"default","tag":"Provisioning","count":11},{"language":"default","tag":"Application Security (AppSec)","count":11},{"language":"default","tag":"GRC","count":9},{"language":"default","tag":"Vulnerability Management (VMS)","count":9}]},"assistantConfig":{},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/edr/get-alert-by-id","slug":"/api-reference/edr/get-alert-by-id","pageMetadata":{"openapi":"get /edr/alerts/{alert_id}","title":"Get Alert by ID","description":"Retrieve an EDR alert by its ID (Leen's UUID).","href":"/api-reference/edr/get-alert-by-id"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Retrieve an EDR alert by its ID (Leen’s UUID).\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"openapi":"get /edr/alerts/{alert_id}","title":"Get Alert by ID","description":"Retrieve an EDR alert by its ID (Leen's UUID).","href":"/api-reference/edr/get-alert-by-id"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"openApiReferenceData":{"operation":{"description":"Retrieve an EDR alert by its ID (Leen's UUID).","operationId":"get_edr_alert_by_id","parameters":["204fef97-c6f3-4a81-aeab-c19196651ec8"],"responses":{"200":"7fc8ed54-d1d8-4fa4-b599-2af8a0120063","404":"141435af-d2c6-4c7c-80b8-052798dcc6aa","422":"d992c71b-4d0f-4bd0-823b-cf863bc3eec5"},"security":["95ad47f8-fb30-48e0-b978-4430c487a72e"],"summary":"Get Alert by ID","tags":["edr"],"method":"get","type":"path","servers":["f90a6b90-72d5-4b55-b234-2914fbc62d65","3361ee71-d73f-428e-a454-e36776673607","5e7aafd1-736a-4f52-bc35-6f2fa35bc169"],"path":"/edr/alerts/{alert_id}","baseUrlOptions":["https://api.leen.dev/v1","https://api.eu-c1.leen.dev/v1","https://api.ap-se2.leen.dev/v1"],"title":"Get Alert by ID","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"204fef97-c6f3-4a81-aeab-c19196651ec8":{"in":"path","name":"alert_id","required":true,"schema":{"format":"uuid","title":"Alert Id","type":"string","isRequired":true,"uniqueKey":"","typeLabel":"string\u003cuuid>"}}},"responses":{"7fc8ed54-d1d8-4fa4-b599-2af8a0120063":{"content":{"application/json":{"schema":{"properties":{"active_directory_domain":{"oneOf":[{"type":"string","title":"Active Directory Domain","description":"Active Directory domain","isRequired":true,"uniqueKey":"active_directory_domain.oneOf.0","typeLabel":"string"},{"type":"null","title":"Active Directory Domain","description":"Active Directory domain","isRequired":true,"uniqueKey":"active_directory_domain.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"active_directory_domain","typeLabel":"string | null"},"active_directory_user_id":{"oneOf":[{"type":"string","title":"Active Directory User Id","description":"Active Directory user ID","isRequired":true,"uniqueKey":"active_directory_user_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Active Directory User Id","description":"Active Directory user ID","isRequired":true,"uniqueKey":"active_directory_user_id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"active_directory_user_id","typeLabel":"string | null"},"assigned_user":{"oneOf":[{"type":"string","title":"Assigned User","description":"Assigned user","isRequired":true,"uniqueKey":"assigned_user.oneOf.0","typeLabel":"string"},{"type":"null","title":"Assigned User","description":"Assigned user","isRequired":true,"uniqueKey":"assigned_user.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"assigned_user","typeLabel":"string | null"},"description":{"oneOf":[{"type":"string","title":"Description","description":"Description of alert, provided by the upstream vendor","isRequired":true,"uniqueKey":"description.oneOf.0","typeLabel":"string"},{"type":"null","title":"Description","description":"Description of alert, provided by the upstream vendor","isRequired":true,"uniqueKey":"description.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"description","typeLabel":"string | null"},"device":{"oneOf":[{"type":"object","title":"Device","description":"Device attached to the alert, include device groups with includeDeviceGroups query parameter","required":["id","status","last_seen","first_seen","source_vendors","installed_software","ad_info"],"properties":{"ad_info":{"oneOf":[{"type":"object","title":"DeviceADInfo","description":"Active Directory placement -- organisational unit and site -- where the tool reports it.","properties":{"device_id":{"oneOf":[{"type":"string","title":"Device Id","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.device_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Device Id","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.device_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.ad_info.oneOf.0.device_id","typeLabel":"string | null"},"domain":{"oneOf":[{"type":"string","title":"Domain","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.domain.oneOf.0","typeLabel":"string"},{"type":"null","title":"Domain","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.domain.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.ad_info.oneOf.0.domain","typeLabel":"string | null"},"org_unit":{"oneOf":[{"type":"string","title":"Org Unit","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.org_unit.oneOf.0","typeLabel":"string"},{"type":"null","title":"Org Unit","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.org_unit.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.ad_info.oneOf.0.org_unit","typeLabel":"string | null"},"site_name":{"oneOf":[{"type":"string","title":"Site Name","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.site_name.oneOf.0","typeLabel":"string"},{"type":"null","title":"Site Name","uniqueKey":"device.oneOf.0.ad_info.oneOf.0.site_name.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.ad_info.oneOf.0.site_name","typeLabel":"string | null"}},"isRequired":true,"uniqueKey":"device.oneOf.0.ad_info.oneOf.0","typeLabel":"DeviceADInfo · object"},{"type":"null","description":"Active Directory placement -- organisational unit and site -- where the tool reports it.","isRequired":true,"uniqueKey":"device.oneOf.0.ad_info.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.0.ad_info","typeLabel":"DeviceADInfo · object | null"},"first_seen":{"oneOf":[{"type":"string","title":"First Seen","description":"When the tool first registered this device. The tool's own timestamp, not when Leen synced it.","format":"date-time","isRequired":true,"uniqueKey":"device.oneOf.0.first_seen.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"First Seen","description":"When the tool first registered this device. The tool's own timestamp, not when Leen synced it.","isRequired":true,"uniqueKey":"device.oneOf.0.first_seen.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.0.first_seen","typeLabel":"string\u003cdate-time> | null"},"id":{"description":"Leen's identifier for this device.","format":"uuid","title":"Id","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.id","typeLabel":"string\u003cuuid>"},"installed_software":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.0.installed_software.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Installed Software","description":"Software the tool reported as installed.","isRequired":true,"uniqueKey":"device.oneOf.0.installed_software.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Installed Software","description":"Software the tool reported as installed.","isRequired":true,"uniqueKey":"device.oneOf.0.installed_software.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.0.installed_software","typeLabel":"string[] | null"},"last_seen":{"oneOf":[{"type":"string","title":"Last Seen","description":"When the tool last had contact with the device. Use it to tell a decommissioned machine from one that simply has no findings.","format":"date-time","isRequired":true,"uniqueKey":"device.oneOf.0.last_seen.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Last Seen","description":"When the tool last had contact with the device. Use it to tell a decommissioned machine from one that simply has no findings.","isRequired":true,"uniqueKey":"device.oneOf.0.last_seen.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.0.last_seen","typeLabel":"string\u003cdate-time> | null"},"source_vendors":{"description":"The tool this device came from, and that tool's identifier for it. A list because the shape allows several; today a device carries exactly one.","items":{"properties":{"vendor":{"title":"Vendor","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].vendor","typeLabel":"string"},"vendor_id":{"title":"Vendor Id","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].vendor_id","typeLabel":"string"},"agent_info":{"oneOf":[{"type":"object","title":"DeviceAgentInfo","properties":{"agent_version":{"oneOf":[{"type":"string","title":"Agent Version","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.agent_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Agent Version","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.agent_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.agent_version","typeLabel":"string | null"},"policies":{"oneOf":[{"type":"array","items":{"additionalProperties":true,"type":"object","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.policies.oneOf.0.items.[INDEX]","typeLabel":"object"},"title":"Policies","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.policies.oneOf.0","typeLabel":"Policies · object[]"},{"type":"null","title":"Policies","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.policies.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.policies","typeLabel":"Policies · object[] | null"},"signature_version":{"oneOf":[{"type":"string","title":"Signature Version","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.signature_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Signature Version","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.signature_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0.signature_version","typeLabel":"string | null"}},"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.0","typeLabel":"DeviceAgentInfo · object"},{"type":"null","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX].agent_info","typeLabel":"DeviceAgentInfo · object | null"}},"required":["vendor","vendor_id"],"title":"DeviceVendor","type":"object","uniqueKey":"device.oneOf.0.source_vendors.items.[INDEX]","typeLabel":"DeviceVendor · object"},"title":"Source Vendors","type":"array","isRequired":true,"uniqueKey":"device.oneOf.0.source_vendors","typeLabel":"DeviceVendor · object[]"},"status":{"enum":["active","offline","quarantined","unknown","deleted"],"title":"DeviceStatus","type":"string","description":"Device state as the tool reports it. `quarantined` means the tool has isolated it; `deleted` means the tool no longer returns it.","isRequired":true,"uniqueKey":"device.oneOf.0.status","typeLabel":"enum\u003cstring>"},"cloud_metadata":{"oneOf":[{"type":"object","title":"AWSMetadata","description":"CloudMetadata, currently only AWS is supported","properties":{"account_id":{"oneOf":[{"type":"string","title":"Account Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.account_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Account Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.account_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.account_id","typeLabel":"string | null"},"availability_zone":{"oneOf":[{"type":"string","title":"Availability Zone","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.availability_zone.oneOf.0","typeLabel":"string"},{"type":"null","title":"Availability Zone","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.availability_zone.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.availability_zone","typeLabel":"string | null"},"cloud_provider":{"enum":["aws"],"title":"CloudProvider","type":"string","default":"aws","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.cloud_provider","typeLabel":"enum\u003cstring>"},"image_id":{"oneOf":[{"type":"string","title":"Image Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.image_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Image Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.image_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.image_id","typeLabel":"string | null"},"instance_id":{"oneOf":[{"type":"string","title":"Instance Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.instance_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Instance Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.instance_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.instance_id","typeLabel":"string | null"},"instance_type":{"oneOf":[{"type":"string","title":"Instance Type","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.instance_type.oneOf.0","typeLabel":"string"},{"type":"null","title":"Instance Type","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.instance_type.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.instance_type","typeLabel":"string | null"},"kernel_id":{"oneOf":[{"type":"string","title":"Kernel Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.kernel_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Kernel Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.kernel_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.kernel_id","typeLabel":"string | null"},"region":{"oneOf":[{"type":"string","title":"Region","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.region.oneOf.0","typeLabel":"string"},{"type":"null","title":"Region","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.region.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.region","typeLabel":"string | null"},"subnet_id":{"oneOf":[{"type":"string","title":"Subnet Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.subnet_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Subnet Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.subnet_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.subnet_id","typeLabel":"string | null"},"vpc_id":{"oneOf":[{"type":"string","title":"Vpc Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.vpc_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Vpc Id","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.vpc_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0.vpc_id","typeLabel":"string | null"}},"uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.0","typeLabel":"AWSMetadata · object"},{"type":"null","description":"CloudMetadata, currently only AWS is supported","uniqueKey":"device.oneOf.0.cloud_metadata.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.cloud_metadata","typeLabel":"AWSMetadata · object | null"},"fqdns":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.0.fqdns.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Fqdns","description":"Fully qualified domain names for this device.","uniqueKey":"device.oneOf.0.fqdns.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Fqdns","description":"Fully qualified domain names for this device.","uniqueKey":"device.oneOf.0.fqdns.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.fqdns","typeLabel":"string[] | null"},"hostnames":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.0.hostnames.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Hostnames","description":"Hostnames the tool knows this device by. A device can have several.","uniqueKey":"device.oneOf.0.hostnames.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Hostnames","description":"Hostnames the tool knows this device by. A device can have several.","uniqueKey":"device.oneOf.0.hostnames.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.hostnames","typeLabel":"string[] | null"},"identities":{"oneOf":[{"type":"array","items":{"properties":{"username":{"title":"Username","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.identities.oneOf.0.items.[INDEX].username","typeLabel":"string"},"user_sid":{"oneOf":[{"type":"string","title":"User Sid","uniqueKey":"device.oneOf.0.identities.oneOf.0.items.[INDEX].user_sid.oneOf.0","typeLabel":"string"},{"type":"null","title":"User Sid","uniqueKey":"device.oneOf.0.identities.oneOf.0.items.[INDEX].user_sid.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.identities.oneOf.0.items.[INDEX].user_sid","typeLabel":"string | null"}},"required":["username"],"title":"DeviceIdentity","type":"object","uniqueKey":"device.oneOf.0.identities.oneOf.0.items.[INDEX]","typeLabel":"DeviceIdentity · object"},"title":"Identities","description":"Accounts associated with the device, such as its last logged-in user.","uniqueKey":"device.oneOf.0.identities.oneOf.0","typeLabel":"DeviceIdentity · object[]"},{"type":"null","title":"Identities","description":"Accounts associated with the device, such as its last logged-in user.","uniqueKey":"device.oneOf.0.identities.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.identities","typeLabel":"DeviceIdentity · object[] | null"},"ipv4s":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.0.ipv4s.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Ipv4S","description":"IPv4 addresses the tool last observed. Not necessarily current.","uniqueKey":"device.oneOf.0.ipv4s.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Ipv4S","description":"IPv4 addresses the tool last observed. Not necessarily current.","uniqueKey":"device.oneOf.0.ipv4s.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.ipv4s","typeLabel":"string[] | null"},"ipv6s":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.0.ipv6s.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Ipv6S","description":"IPv6 addresses the tool last observed.","uniqueKey":"device.oneOf.0.ipv6s.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Ipv6S","description":"IPv6 addresses the tool last observed.","uniqueKey":"device.oneOf.0.ipv6s.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.ipv6s","typeLabel":"string[] | null"},"mac_addresses":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.0.mac_addresses.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Mac Addresses","description":"MAC addresses of the device's interfaces.","uniqueKey":"device.oneOf.0.mac_addresses.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Mac Addresses","description":"MAC addresses of the device's interfaces.","uniqueKey":"device.oneOf.0.mac_addresses.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.mac_addresses","typeLabel":"string[] | null"},"os_major_version":{"oneOf":[{"type":"string","title":"Os Major Version","description":"Major version, split out of `os_version` so it can be filtered on.","uniqueKey":"device.oneOf.0.os_major_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Os Major Version","description":"Major version, split out of `os_version` so it can be filtered on.","uniqueKey":"device.oneOf.0.os_major_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.os_major_version","typeLabel":"string | null"},"os_minor_version":{"oneOf":[{"type":"string","title":"Os Minor Version","description":"Minor version, split out of `os_version`.","uniqueKey":"device.oneOf.0.os_minor_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Os Minor Version","description":"Minor version, split out of `os_version`.","uniqueKey":"device.oneOf.0.os_minor_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.os_minor_version","typeLabel":"string | null"},"os_version":{"oneOf":[{"type":"string","title":"Os Version","description":"Full operating system version string, as the tool reports it.","uniqueKey":"device.oneOf.0.os_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Os Version","description":"Full operating system version string, as the tool reports it.","uniqueKey":"device.oneOf.0.os_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.os_version","typeLabel":"string | null"},"platform":{"oneOf":[{"type":"string","title":"DevicePlatform","description":"Operating system family, normalised across tools.","enum":["mac","windows","linux","unknown"],"uniqueKey":"device.oneOf.0.platform.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","description":"Operating system family, normalised across tools.","uniqueKey":"device.oneOf.0.platform.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.platform","typeLabel":"enum\u003cstring> | null"},"tags":{"oneOf":[{"type":"array","items":{"properties":{"key":{"title":"Key","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.tags.oneOf.0.items.[INDEX].key","typeLabel":"string"},"source":{"enum":["aws","qualys","wiz_vms","insight_vm"],"title":"DeviceTagSource","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.tags.oneOf.0.items.[INDEX].source","typeLabel":"enum\u003cstring>"},"value":{"title":"Value","type":"string","isRequired":true,"uniqueKey":"device.oneOf.0.tags.oneOf.0.items.[INDEX].value","typeLabel":"string"}},"required":["key","value","source"],"title":"DeviceTags","type":"object","uniqueKey":"device.oneOf.0.tags.oneOf.0.items.[INDEX]","typeLabel":"DeviceTags · object"},"title":"Tags","description":"Tags the tool carries for this device.","uniqueKey":"device.oneOf.0.tags.oneOf.0","typeLabel":"DeviceTags · object[]"},{"type":"null","title":"Tags","description":"Tags the tool carries for this device.","uniqueKey":"device.oneOf.0.tags.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.tags","typeLabel":"DeviceTags · object[] | null"},"vendor_data":{"oneOf":[{"type":"object","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","additionalProperties":true,"uniqueKey":"device.oneOf.0.vendor_data.oneOf.0","typeLabel":"Vendor Data · object"},{"type":"null","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","uniqueKey":"device.oneOf.0.vendor_data.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.0.vendor_data","typeLabel":"Vendor Data · object | null"}},"isRequired":true,"uniqueKey":"device.oneOf.0","typeLabel":"Device · object"},{"type":"object","title":"DeviceWithGroups","description":"Device attached to the alert, include device groups with includeDeviceGroups query parameter","required":["id","status","last_seen","first_seen","source_vendors","installed_software","ad_info"],"properties":{"ad_info":{"oneOf":[{"type":"object","title":"DeviceADInfo","description":"Active Directory placement -- organisational unit and site -- where the tool reports it.","properties":{"device_id":{"oneOf":[{"type":"string","title":"Device Id","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.device_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Device Id","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.device_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.ad_info.oneOf.0.device_id","typeLabel":"string | null"},"domain":{"oneOf":[{"type":"string","title":"Domain","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.domain.oneOf.0","typeLabel":"string"},{"type":"null","title":"Domain","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.domain.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.ad_info.oneOf.0.domain","typeLabel":"string | null"},"org_unit":{"oneOf":[{"type":"string","title":"Org Unit","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.org_unit.oneOf.0","typeLabel":"string"},{"type":"null","title":"Org Unit","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.org_unit.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.ad_info.oneOf.0.org_unit","typeLabel":"string | null"},"site_name":{"oneOf":[{"type":"string","title":"Site Name","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.site_name.oneOf.0","typeLabel":"string"},{"type":"null","title":"Site Name","uniqueKey":"device.oneOf.1.ad_info.oneOf.0.site_name.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.ad_info.oneOf.0.site_name","typeLabel":"string | null"}},"isRequired":true,"uniqueKey":"device.oneOf.1.ad_info.oneOf.0","typeLabel":"DeviceADInfo · object"},{"type":"null","description":"Active Directory placement -- organisational unit and site -- where the tool reports it.","isRequired":true,"uniqueKey":"device.oneOf.1.ad_info.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.1.ad_info","typeLabel":"DeviceADInfo · object | null"},"first_seen":{"oneOf":[{"type":"string","title":"First Seen","description":"When the tool first registered this device. The tool's own timestamp, not when Leen synced it.","format":"date-time","isRequired":true,"uniqueKey":"device.oneOf.1.first_seen.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"First Seen","description":"When the tool first registered this device. The tool's own timestamp, not when Leen synced it.","isRequired":true,"uniqueKey":"device.oneOf.1.first_seen.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.1.first_seen","typeLabel":"string\u003cdate-time> | null"},"id":{"description":"Leen's identifier for this device.","format":"uuid","title":"Id","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.id","typeLabel":"string\u003cuuid>"},"installed_software":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.1.installed_software.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Installed Software","description":"Software the tool reported as installed.","isRequired":true,"uniqueKey":"device.oneOf.1.installed_software.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Installed Software","description":"Software the tool reported as installed.","isRequired":true,"uniqueKey":"device.oneOf.1.installed_software.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.1.installed_software","typeLabel":"string[] | null"},"last_seen":{"oneOf":[{"type":"string","title":"Last Seen","description":"When the tool last had contact with the device. Use it to tell a decommissioned machine from one that simply has no findings.","format":"date-time","isRequired":true,"uniqueKey":"device.oneOf.1.last_seen.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Last Seen","description":"When the tool last had contact with the device. Use it to tell a decommissioned machine from one that simply has no findings.","isRequired":true,"uniqueKey":"device.oneOf.1.last_seen.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"device.oneOf.1.last_seen","typeLabel":"string\u003cdate-time> | null"},"source_vendors":{"description":"The tool this device came from, and that tool's identifier for it. A list because the shape allows several; today a device carries exactly one.","items":{"properties":{"vendor":{"title":"Vendor","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].vendor","typeLabel":"string"},"vendor_id":{"title":"Vendor Id","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].vendor_id","typeLabel":"string"},"agent_info":{"oneOf":[{"type":"object","title":"DeviceAgentInfo","properties":{"agent_version":{"oneOf":[{"type":"string","title":"Agent Version","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.agent_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Agent Version","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.agent_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.agent_version","typeLabel":"string | null"},"policies":{"oneOf":[{"type":"array","items":{"additionalProperties":true,"type":"object","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.policies.oneOf.0.items.[INDEX]","typeLabel":"object"},"title":"Policies","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.policies.oneOf.0","typeLabel":"Policies · object[]"},{"type":"null","title":"Policies","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.policies.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.policies","typeLabel":"Policies · object[] | null"},"signature_version":{"oneOf":[{"type":"string","title":"Signature Version","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.signature_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Signature Version","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.signature_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0.signature_version","typeLabel":"string | null"}},"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.0","typeLabel":"DeviceAgentInfo · object"},{"type":"null","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX].agent_info","typeLabel":"DeviceAgentInfo · object | null"}},"required":["vendor","vendor_id"],"title":"DeviceVendor","type":"object","uniqueKey":"device.oneOf.1.source_vendors.items.[INDEX]","typeLabel":"DeviceVendor · object"},"title":"Source Vendors","type":"array","isRequired":true,"uniqueKey":"device.oneOf.1.source_vendors","typeLabel":"DeviceVendor · object[]"},"status":{"enum":["active","offline","quarantined","unknown","deleted"],"title":"DeviceStatus","type":"string","description":"Device state as the tool reports it. `quarantined` means the tool has isolated it; `deleted` means the tool no longer returns it.","isRequired":true,"uniqueKey":"device.oneOf.1.status","typeLabel":"enum\u003cstring>"},"cloud_metadata":{"oneOf":[{"type":"object","title":"AWSMetadata","description":"CloudMetadata, currently only AWS is supported","properties":{"account_id":{"oneOf":[{"type":"string","title":"Account Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.account_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Account Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.account_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.account_id","typeLabel":"string | null"},"availability_zone":{"oneOf":[{"type":"string","title":"Availability Zone","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.availability_zone.oneOf.0","typeLabel":"string"},{"type":"null","title":"Availability Zone","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.availability_zone.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.availability_zone","typeLabel":"string | null"},"cloud_provider":{"enum":["aws"],"title":"CloudProvider","type":"string","default":"aws","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.cloud_provider","typeLabel":"enum\u003cstring>"},"image_id":{"oneOf":[{"type":"string","title":"Image Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.image_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Image Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.image_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.image_id","typeLabel":"string | null"},"instance_id":{"oneOf":[{"type":"string","title":"Instance Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.instance_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Instance Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.instance_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.instance_id","typeLabel":"string | null"},"instance_type":{"oneOf":[{"type":"string","title":"Instance Type","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.instance_type.oneOf.0","typeLabel":"string"},{"type":"null","title":"Instance Type","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.instance_type.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.instance_type","typeLabel":"string | null"},"kernel_id":{"oneOf":[{"type":"string","title":"Kernel Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.kernel_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Kernel Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.kernel_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.kernel_id","typeLabel":"string | null"},"region":{"oneOf":[{"type":"string","title":"Region","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.region.oneOf.0","typeLabel":"string"},{"type":"null","title":"Region","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.region.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.region","typeLabel":"string | null"},"subnet_id":{"oneOf":[{"type":"string","title":"Subnet Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.subnet_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Subnet Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.subnet_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.subnet_id","typeLabel":"string | null"},"vpc_id":{"oneOf":[{"type":"string","title":"Vpc Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.vpc_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Vpc Id","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.vpc_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0.vpc_id","typeLabel":"string | null"}},"uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.0","typeLabel":"AWSMetadata · object"},{"type":"null","description":"CloudMetadata, currently only AWS is supported","uniqueKey":"device.oneOf.1.cloud_metadata.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.cloud_metadata","typeLabel":"AWSMetadata · object | null"},"device_groups":{"default":[],"description":"Pass in the includeDeviceGroups query parameter to include device group information.","items":{"properties":{"id":{"description":"Leen's identifier for this group.","format":"uuid","title":"Id","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].id","typeLabel":"string\u003cuuid>"},"name":{"description":"Group name, as the tool names it.","title":"Name","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].name","typeLabel":"string"},"vendor":{"description":"Connector that produced this group.","title":"Vendor","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor","typeLabel":"string"},"vendor_id":{"description":"The tool's own identifier for the group.","title":"Vendor Id","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_id","typeLabel":"string"},"created_by":{"oneOf":[{"type":"string","title":"Created By","description":"Who created the group in the tool.","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].created_by.oneOf.0","typeLabel":"string"},{"type":"null","title":"Created By","description":"Who created the group in the tool.","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].created_by.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].created_by","typeLabel":"string | null"},"description":{"oneOf":[{"type":"string","title":"Description","description":"Group description, where the tool has one.","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].description.oneOf.0","typeLabel":"string"},{"type":"null","title":"Description","description":"Group description, where the tool has one.","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].description.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].description","typeLabel":"string | null"},"vendor_created_at":{"oneOf":[{"type":"string","title":"Vendor Created At","description":"When the group was created in the tool, where the tool reports it.","format":"date-time","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_created_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Vendor Created At","description":"When the group was created in the tool, where the tool reports it.","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_created_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_created_at","typeLabel":"string\u003cdate-time> | null"},"vendor_data":{"oneOf":[{"type":"object","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","additionalProperties":true,"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_data.oneOf.0","typeLabel":"Vendor Data · object"},{"type":"null","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_data.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.device_groups.items.[INDEX].vendor_data","typeLabel":"Vendor Data · object | null"}},"required":["id","name","vendor_id","vendor"],"title":"DeviceGroupsBase","type":"object","uniqueKey":"device.oneOf.1.device_groups.items.[INDEX]","typeLabel":"DeviceGroupsBase · object"},"title":"Device Groups","type":"array","uniqueKey":"device.oneOf.1.device_groups","typeLabel":"DeviceGroupsBase · object[]"},"fqdns":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.1.fqdns.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Fqdns","description":"Fully qualified domain names for this device.","uniqueKey":"device.oneOf.1.fqdns.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Fqdns","description":"Fully qualified domain names for this device.","uniqueKey":"device.oneOf.1.fqdns.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.fqdns","typeLabel":"string[] | null"},"hostnames":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.1.hostnames.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Hostnames","description":"Hostnames the tool knows this device by. A device can have several.","uniqueKey":"device.oneOf.1.hostnames.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Hostnames","description":"Hostnames the tool knows this device by. A device can have several.","uniqueKey":"device.oneOf.1.hostnames.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.hostnames","typeLabel":"string[] | null"},"identities":{"oneOf":[{"type":"array","items":{"properties":{"username":{"title":"Username","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.identities.oneOf.0.items.[INDEX].username","typeLabel":"string"},"user_sid":{"oneOf":[{"type":"string","title":"User Sid","uniqueKey":"device.oneOf.1.identities.oneOf.0.items.[INDEX].user_sid.oneOf.0","typeLabel":"string"},{"type":"null","title":"User Sid","uniqueKey":"device.oneOf.1.identities.oneOf.0.items.[INDEX].user_sid.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.identities.oneOf.0.items.[INDEX].user_sid","typeLabel":"string | null"}},"required":["username"],"title":"DeviceIdentity","type":"object","uniqueKey":"device.oneOf.1.identities.oneOf.0.items.[INDEX]","typeLabel":"DeviceIdentity · object"},"title":"Identities","description":"Accounts associated with the device, such as its last logged-in user.","uniqueKey":"device.oneOf.1.identities.oneOf.0","typeLabel":"DeviceIdentity · object[]"},{"type":"null","title":"Identities","description":"Accounts associated with the device, such as its last logged-in user.","uniqueKey":"device.oneOf.1.identities.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.identities","typeLabel":"DeviceIdentity · object[] | null"},"ipv4s":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.1.ipv4s.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Ipv4S","description":"IPv4 addresses the tool last observed. Not necessarily current.","uniqueKey":"device.oneOf.1.ipv4s.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Ipv4S","description":"IPv4 addresses the tool last observed. Not necessarily current.","uniqueKey":"device.oneOf.1.ipv4s.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.ipv4s","typeLabel":"string[] | null"},"ipv6s":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.1.ipv6s.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Ipv6S","description":"IPv6 addresses the tool last observed.","uniqueKey":"device.oneOf.1.ipv6s.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Ipv6S","description":"IPv6 addresses the tool last observed.","uniqueKey":"device.oneOf.1.ipv6s.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.ipv6s","typeLabel":"string[] | null"},"mac_addresses":{"oneOf":[{"type":"array","items":{"type":"string","uniqueKey":"device.oneOf.1.mac_addresses.oneOf.0.items.[INDEX]","typeLabel":"string"},"title":"Mac Addresses","description":"MAC addresses of the device's interfaces.","uniqueKey":"device.oneOf.1.mac_addresses.oneOf.0","typeLabel":"string[]"},{"type":"null","title":"Mac Addresses","description":"MAC addresses of the device's interfaces.","uniqueKey":"device.oneOf.1.mac_addresses.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.mac_addresses","typeLabel":"string[] | null"},"os_major_version":{"oneOf":[{"type":"string","title":"Os Major Version","description":"Major version, split out of `os_version` so it can be filtered on.","uniqueKey":"device.oneOf.1.os_major_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Os Major Version","description":"Major version, split out of `os_version` so it can be filtered on.","uniqueKey":"device.oneOf.1.os_major_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.os_major_version","typeLabel":"string | null"},"os_minor_version":{"oneOf":[{"type":"string","title":"Os Minor Version","description":"Minor version, split out of `os_version`.","uniqueKey":"device.oneOf.1.os_minor_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Os Minor Version","description":"Minor version, split out of `os_version`.","uniqueKey":"device.oneOf.1.os_minor_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.os_minor_version","typeLabel":"string | null"},"os_version":{"oneOf":[{"type":"string","title":"Os Version","description":"Full operating system version string, as the tool reports it.","uniqueKey":"device.oneOf.1.os_version.oneOf.0","typeLabel":"string"},{"type":"null","title":"Os Version","description":"Full operating system version string, as the tool reports it.","uniqueKey":"device.oneOf.1.os_version.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.os_version","typeLabel":"string | null"},"platform":{"oneOf":[{"type":"string","title":"DevicePlatform","description":"Operating system family, normalised across tools.","enum":["mac","windows","linux","unknown"],"uniqueKey":"device.oneOf.1.platform.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","description":"Operating system family, normalised across tools.","uniqueKey":"device.oneOf.1.platform.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.platform","typeLabel":"enum\u003cstring> | null"},"tags":{"oneOf":[{"type":"array","items":{"properties":{"key":{"title":"Key","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.tags.oneOf.0.items.[INDEX].key","typeLabel":"string"},"source":{"enum":["aws","qualys","wiz_vms","insight_vm"],"title":"DeviceTagSource","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.tags.oneOf.0.items.[INDEX].source","typeLabel":"enum\u003cstring>"},"value":{"title":"Value","type":"string","isRequired":true,"uniqueKey":"device.oneOf.1.tags.oneOf.0.items.[INDEX].value","typeLabel":"string"}},"required":["key","value","source"],"title":"DeviceTags","type":"object","uniqueKey":"device.oneOf.1.tags.oneOf.0.items.[INDEX]","typeLabel":"DeviceTags · object"},"title":"Tags","description":"Tags the tool carries for this device.","uniqueKey":"device.oneOf.1.tags.oneOf.0","typeLabel":"DeviceTags · object[]"},{"type":"null","title":"Tags","description":"Tags the tool carries for this device.","uniqueKey":"device.oneOf.1.tags.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.tags","typeLabel":"DeviceTags · object[] | null"},"vendor_data":{"oneOf":[{"type":"object","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","additionalProperties":true,"uniqueKey":"device.oneOf.1.vendor_data.oneOf.0","typeLabel":"Vendor Data · object"},{"type":"null","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","uniqueKey":"device.oneOf.1.vendor_data.oneOf.1","typeLabel":"null"}],"uniqueKey":"device.oneOf.1.vendor_data","typeLabel":"Vendor Data · object | null"}},"isRequired":true,"uniqueKey":"device.oneOf.1","typeLabel":"DeviceWithGroups · object"}],"isRequired":true,"uniqueKey":"device","typeLabel":"Device · object | DeviceWithGroups · object"},"first_event_time":{"oneOf":[{"type":"string","title":"First Event Time","description":"First event time","format":"date-time","isRequired":true,"uniqueKey":"first_event_time.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"First Event Time","description":"First event time","isRequired":true,"uniqueKey":"first_event_time.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"first_event_time","typeLabel":"string\u003cdate-time> | null"},"last_event_time":{"oneOf":[{"type":"string","title":"Last Event Time","description":"Last event time","format":"date-time","isRequired":true,"uniqueKey":"last_event_time.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Last Event Time","description":"Last event time","isRequired":true,"uniqueKey":"last_event_time.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"last_event_time","typeLabel":"string\u003cdate-time> | null"},"mitre":{"description":"MITRE Tactics associated with the alert","items":{"properties":{"techniques":{"description":"Techniques associated with the tactic","items":{"properties":{"technique_id":{"oneOf":[{"type":"string","title":"Technique Id","description":"Technique ID","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Technique Id","description":"Technique ID","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_id","typeLabel":"string | null"},"technique_link":{"oneOf":[{"type":"string","title":"Technique Link","description":"Technique link","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_link.oneOf.0","typeLabel":"string"},{"type":"null","title":"Technique Link","description":"Technique link","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_link.oneOf.1","typeLabel":"null"}],"uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_link","typeLabel":"string | null"},"technique_name":{"oneOf":[{"type":"string","title":"Technique Name","description":"Technique name","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_name.oneOf.0","typeLabel":"string"},{"type":"null","title":"Technique Name","description":"Technique name","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_name.oneOf.1","typeLabel":"null"}],"uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX].technique_name","typeLabel":"string | null"}},"title":"ScopedEDRAlertRespModelMitreTacticTechnique","type":"object","uniqueKey":"mitre.items.[INDEX].techniques.items.[INDEX]","typeLabel":"ScopedEDRAlertRespModelMitreTacticTechnique · object"},"title":"Techniques","type":"array","isRequired":true,"uniqueKey":"mitre.items.[INDEX].techniques","typeLabel":"ScopedEDRAlertRespModelMitreTacticTechnique · object[]"},"tactic_id":{"oneOf":[{"type":"string","title":"Tactic Id","description":"Tactic ID","uniqueKey":"mitre.items.[INDEX].tactic_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Tactic Id","description":"Tactic ID","uniqueKey":"mitre.items.[INDEX].tactic_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"mitre.items.[INDEX].tactic_id","typeLabel":"string | null"},"tactic_name":{"oneOf":[{"type":"string","title":"Tactic Name","description":"Tactic name","uniqueKey":"mitre.items.[INDEX].tactic_name.oneOf.0","typeLabel":"string"},{"type":"null","title":"Tactic Name","description":"Tactic name","uniqueKey":"mitre.items.[INDEX].tactic_name.oneOf.1","typeLabel":"null"}],"uniqueKey":"mitre.items.[INDEX].tactic_name","typeLabel":"string | null"},"tactic_source":{"oneOf":[{"type":"string","title":"Tactic Source","description":"Tactic source","uniqueKey":"mitre.items.[INDEX].tactic_source.oneOf.0","typeLabel":"string"},{"type":"null","title":"Tactic Source","description":"Tactic source","uniqueKey":"mitre.items.[INDEX].tactic_source.oneOf.1","typeLabel":"null"}],"uniqueKey":"mitre.items.[INDEX].tactic_source","typeLabel":"string | null"}},"required":["techniques"],"title":"ScopedEDRAlertRespModelMitreTactic","type":"object","uniqueKey":"mitre.items.[INDEX]","typeLabel":"ScopedEDRAlertRespModelMitreTactic · object"},"title":"Mitre","type":"array","isRequired":true,"uniqueKey":"mitre","typeLabel":"ScopedEDRAlertRespModelMitreTactic · object[]"},"parent_pid":{"oneOf":[{"type":"string","title":"Parent Pid","description":"Parent process ID","isRequired":true,"uniqueKey":"parent_pid.oneOf.0","typeLabel":"string"},{"type":"null","title":"Parent Pid","description":"Parent process ID","isRequired":true,"uniqueKey":"parent_pid.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"parent_pid","typeLabel":"string | null"},"pid":{"oneOf":[{"type":"string","title":"Pid","description":"Process ID","isRequired":true,"uniqueKey":"pid.oneOf.0","typeLabel":"string"},{"type":"null","title":"Pid","description":"Process ID","isRequired":true,"uniqueKey":"pid.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"pid","typeLabel":"string | null"},"process_command_line":{"oneOf":[{"type":"string","title":"Process Command Line","description":"Process command line","isRequired":true,"uniqueKey":"process_command_line.oneOf.0","typeLabel":"string"},{"type":"null","title":"Process Command Line","description":"Process command line","isRequired":true,"uniqueKey":"process_command_line.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_command_line","typeLabel":"string | null"},"process_created_at":{"oneOf":[{"type":"string","title":"Process Created At","description":"Process created at","format":"date-time","isRequired":true,"uniqueKey":"process_created_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Process Created At","description":"Process created at","isRequired":true,"uniqueKey":"process_created_at.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_created_at","typeLabel":"string\u003cdate-time> | null"},"process_filename":{"oneOf":[{"type":"string","title":"Process Filename","description":"Process filename","isRequired":true,"uniqueKey":"process_filename.oneOf.0","typeLabel":"string"},{"type":"null","title":"Process Filename","description":"Process filename","isRequired":true,"uniqueKey":"process_filename.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_filename","typeLabel":"string | null"},"process_filepath":{"oneOf":[{"type":"string","title":"Process Filepath","description":"Process filepath","isRequired":true,"uniqueKey":"process_filepath.oneOf.0","typeLabel":"string"},{"type":"null","title":"Process Filepath","description":"Process filepath","isRequired":true,"uniqueKey":"process_filepath.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_filepath","typeLabel":"string | null"},"process_md5":{"oneOf":[{"type":"string","title":"Process Md5","description":"Process MD5","isRequired":true,"uniqueKey":"process_md5.oneOf.0","typeLabel":"string"},{"type":"null","title":"Process Md5","description":"Process MD5","isRequired":true,"uniqueKey":"process_md5.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_md5","typeLabel":"string | null"},"process_sha1":{"oneOf":[{"type":"string","title":"Process Sha1","description":"Process SHA1","isRequired":true,"uniqueKey":"process_sha1.oneOf.0","typeLabel":"string"},{"type":"null","title":"Process Sha1","description":"Process SHA1","isRequired":true,"uniqueKey":"process_sha1.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_sha1","typeLabel":"string | null"},"process_sha256":{"oneOf":[{"type":"string","title":"Process Sha256","description":"Process SHA256","isRequired":true,"uniqueKey":"process_sha256.oneOf.0","typeLabel":"string"},{"type":"null","title":"Process Sha256","description":"Process SHA256","isRequired":true,"uniqueKey":"process_sha256.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"process_sha256","typeLabel":"string | null"},"resolved_time":{"oneOf":[{"type":"string","title":"Resolved Time","description":"Resolved time","format":"date-time","isRequired":true,"uniqueKey":"resolved_time.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Resolved Time","description":"Resolved time","isRequired":true,"uniqueKey":"resolved_time.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"resolved_time","typeLabel":"string\u003cdate-time> | null"},"title":{"oneOf":[{"type":"string","title":"Title","description":"Title of the alert, provided by the upstream vendor","isRequired":true,"uniqueKey":"title.oneOf.0","typeLabel":"string"},{"type":"null","title":"Title","description":"Title of the alert, provided by the upstream vendor","isRequired":true,"uniqueKey":"title.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"title","typeLabel":"string | null"},"user_name":{"oneOf":[{"type":"string","title":"User Name","description":"User name","isRequired":true,"uniqueKey":"user_name.oneOf.0","typeLabel":"string"},{"type":"null","title":"User Name","description":"User name","isRequired":true,"uniqueKey":"user_name.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"user_name","typeLabel":"string | null"},"vendor":{"enum":["crowdstrike","ms_defender_endpoint","sentinelone"],"title":"ScopedEDRAlertVendor","type":"string","description":"Source vendor","isRequired":true,"uniqueKey":"vendor","typeLabel":"enum\u003cstring>"},"vendor_id":{"oneOf":[{"type":"string","title":"Vendor Id","description":"Vendor's ID of the alert","isRequired":true,"uniqueKey":"vendor_id.oneOf.0","typeLabel":"string"},{"type":"null","title":"Vendor Id","description":"Vendor's ID of the alert","isRequired":true,"uniqueKey":"vendor_id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"vendor_id","typeLabel":"string | null"},"vendor_severity":{"oneOf":[{"type":"string","title":"Vendor Severity","description":"Vendor's severity","isRequired":true,"uniqueKey":"vendor_severity.oneOf.0","typeLabel":"string"},{"type":"null","title":"Vendor Severity","description":"Vendor's severity","isRequired":true,"uniqueKey":"vendor_severity.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"vendor_severity","typeLabel":"string | null"},"vendor_status":{"oneOf":[{"type":"string","title":"Vendor Status","description":"Vendor's status","isRequired":true,"uniqueKey":"vendor_status.oneOf.0","typeLabel":"string"},{"type":"null","title":"Vendor Status","description":"Vendor's status","isRequired":true,"uniqueKey":"vendor_status.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"vendor_status","typeLabel":"string | null"},"verdict":{"enum":["FALSE_POSITIVE","TRUE_POSITIVE","SUSPICIOUS","IGNORED","UNKNOWN"],"title":"AlertVerdict","type":"string","description":"Analyst verdict","isRequired":true,"uniqueKey":"verdict","typeLabel":"enum\u003cstring>"},"windows_sid":{"oneOf":[{"type":"string","title":"Windows Sid","description":"Windows SID","isRequired":true,"uniqueKey":"windows_sid.oneOf.0","typeLabel":"string"},{"type":"null","title":"Windows Sid","description":"Windows SID","isRequired":true,"uniqueKey":"windows_sid.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"windows_sid","typeLabel":"string | null"},"id":{"oneOf":[{"type":"string","title":"Id","description":"Leen's identifier for this alert.","format":"uuid","uniqueKey":"id.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","title":"Id","description":"Leen's identifier for this alert.","uniqueKey":"id.oneOf.1","typeLabel":"null"}],"uniqueKey":"id","typeLabel":"string\u003cuuid> | null"},"observables":{"oneOf":[{"type":"array","items":{"description":"OCSF Observable object","properties":{"name":{"description":"The full name of the observable attribute","title":"Name","type":"string","isRequired":true,"uniqueKey":"observables.oneOf.0.items.[INDEX].name","typeLabel":"string"},"type_id":{"description":"The observable value type identifier","enum":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,99],"title":"OCSFObservableTypeID","type":"integer","isRequired":true,"uniqueKey":"observables.oneOf.0.items.[INDEX].type_id","typeLabel":"enum\u003cinteger>"},"type":{"oneOf":[{"type":"string","title":"OCSFObservableType","description":"The observable data type string representation","enum":["UNKNOWN","HOSTNAME","IP_ADDRESS","MAC_ADDRESS","USER_NAME","EMAIL_ADDRESS","URL_STRING","FILE_NAME","HASH","PROCESS_NAME","RESOURCE_UID","PORT","SUBNET","COMMAND_LINE","COUNTRY","PROCESS_ID","HTTP_USER_AGENT","CWE_UID","CVE_UID","USER_CREDENTIAL_ID","ENDPOINT","USER","EMAIL","URL","FILE","PROCESS","GEO_LOCATION","CONTAINER","REGISTRY_KEY","REGISTRY_VALUE","FINGERPRINT","OTHER"],"uniqueKey":"observables.oneOf.0.items.[INDEX].type.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","description":"The observable data type string representation","uniqueKey":"observables.oneOf.0.items.[INDEX].type.oneOf.1","typeLabel":"null"}],"uniqueKey":"observables.oneOf.0.items.[INDEX].type","typeLabel":"enum\u003cstring> | null"},"value":{"oneOf":[{"type":"string","title":"Value","description":"The value associated with the observable attribute. The meaning of the value depends on the observable type","uniqueKey":"observables.oneOf.0.items.[INDEX].value.oneOf.0","typeLabel":"string"},{"type":"null","title":"Value","description":"The value associated with the observable attribute. The meaning of the value depends on the observable type","uniqueKey":"observables.oneOf.0.items.[INDEX].value.oneOf.1","typeLabel":"null"}],"uniqueKey":"observables.oneOf.0.items.[INDEX].value","typeLabel":"string | null"}},"required":["name","type_id"],"title":"OCSFObservable","type":"object","uniqueKey":"observables.oneOf.0.items.[INDEX]","typeLabel":"OCSFObservable · object"},"title":"Observables","description":"Observable data associated with the alert","uniqueKey":"observables.oneOf.0","typeLabel":"OCSFObservable · object[]"},{"type":"null","title":"Observables","description":"Observable data associated with the alert","uniqueKey":"observables.oneOf.1","typeLabel":"null"}],"uniqueKey":"observables","typeLabel":"OCSFObservable · object[] | null"},"severity":{"enum":["none","low","medium","high","critical","info"],"title":"ScopedEDRAlertSeverity","type":"string","default":"none","description":"Alert severity","uniqueKey":"severity","typeLabel":"enum\u003cstring>"},"status":{"enum":["unknown","new","in_progress","unresolved","resolved"],"title":"ScopedEDRAlertStatus","type":"string","default":"unknown","description":"Alert status","uniqueKey":"status","typeLabel":"enum\u003cstring>"},"vendor_data":{"oneOf":[{"type":"object","title":"CrowdStrikeEDRVendorData","description":"Vendor specific pass through data, values can vary based on vendor","required":["aggregate_id"],"properties":{"aggregate_id":{"title":"Aggregate Id","type":"string","isRequired":true,"uniqueKey":"vendor_data.oneOf.0.aggregate_id","typeLabel":"string"},"created_at":{"oneOf":[{"type":"string","title":"Created At","format":"date-time","uniqueKey":"vendor_data.oneOf.0.created_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Created At","uniqueKey":"vendor_data.oneOf.0.created_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.0.created_at","typeLabel":"string\u003cdate-time> | null"},"falcon_host_link":{"oneOf":[{"type":"string","title":"Falcon Host Link","uniqueKey":"vendor_data.oneOf.0.falcon_host_link.oneOf.0","typeLabel":"string"},{"type":"null","title":"Falcon Host Link","uniqueKey":"vendor_data.oneOf.0.falcon_host_link.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.0.falcon_host_link","typeLabel":"string | null"},"updated_at":{"oneOf":[{"type":"string","title":"Updated At","format":"date-time","uniqueKey":"vendor_data.oneOf.0.updated_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Updated At","uniqueKey":"vendor_data.oneOf.0.updated_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.0.updated_at","typeLabel":"string\u003cdate-time> | null"},"vendor":{"const":"CROWDSTRIKE","default":"CROWDSTRIKE","title":"Vendor","type":"string","uniqueKey":"vendor_data.oneOf.0.vendor","typeLabel":"string"}},"uniqueKey":"vendor_data.oneOf.0","typeLabel":"CrowdStrikeEDRVendorData · object"},{"type":"object","title":"MSDefenderEDRVendorData","description":"Vendor specific pass through data, values can vary based on vendor","properties":{"classification":{"oneOf":[{"type":"string","title":"Classification","uniqueKey":"vendor_data.oneOf.1.classification.oneOf.0","typeLabel":"string"},{"type":"null","title":"Classification","uniqueKey":"vendor_data.oneOf.1.classification.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.1.classification","typeLabel":"string | null"},"created_at":{"oneOf":[{"type":"string","title":"Created At","format":"date-time","uniqueKey":"vendor_data.oneOf.1.created_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Created At","uniqueKey":"vendor_data.oneOf.1.created_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.1.created_at","typeLabel":"string\u003cdate-time> | null"},"determination":{"oneOf":[{"type":"string","title":"Determination","uniqueKey":"vendor_data.oneOf.1.determination.oneOf.0","typeLabel":"string"},{"type":"null","title":"Determination","uniqueKey":"vendor_data.oneOf.1.determination.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.1.determination","typeLabel":"string | null"},"updated_at":{"oneOf":[{"type":"string","title":"Updated At","format":"date-time","uniqueKey":"vendor_data.oneOf.1.updated_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Updated At","uniqueKey":"vendor_data.oneOf.1.updated_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.1.updated_at","typeLabel":"string\u003cdate-time> | null"},"vendor":{"const":"MS_DEFENDER_ENDPOINT","default":"MS_DEFENDER_ENDPOINT","title":"Vendor","type":"string","uniqueKey":"vendor_data.oneOf.1.vendor","typeLabel":"string"}},"uniqueKey":"vendor_data.oneOf.1","typeLabel":"MSDefenderEDRVendorData · object"},{"type":"object","title":"SentinelOneEDRVendorData","description":"Vendor specific pass through data, values can vary based on vendor","properties":{"analyst_verdict":{"oneOf":[{"type":"string","title":"Analyst Verdict","uniqueKey":"vendor_data.oneOf.2.analyst_verdict.oneOf.0","typeLabel":"string"},{"type":"null","title":"Analyst Verdict","uniqueKey":"vendor_data.oneOf.2.analyst_verdict.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.2.analyst_verdict","typeLabel":"string | null"},"created_at":{"oneOf":[{"type":"string","title":"Created At","format":"date-time","uniqueKey":"vendor_data.oneOf.2.created_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Created At","uniqueKey":"vendor_data.oneOf.2.created_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.2.created_at","typeLabel":"string\u003cdate-time> | null"},"updated_at":{"oneOf":[{"type":"string","title":"Updated At","format":"date-time","uniqueKey":"vendor_data.oneOf.2.updated_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","title":"Updated At","uniqueKey":"vendor_data.oneOf.2.updated_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"vendor_data.oneOf.2.updated_at","typeLabel":"string\u003cdate-time> | null"},"vendor":{"const":"SENTINELONE","default":"SENTINELONE","title":"Vendor","type":"string","uniqueKey":"vendor_data.oneOf.2.vendor","typeLabel":"string"}},"uniqueKey":"vendor_data.oneOf.2","typeLabel":"SentinelOneEDRVendorData · object"},{"type":"null","title":"Vendor Data","description":"Vendor specific pass through data, values can vary based on vendor","uniqueKey":"vendor_data.oneOf.3","typeLabel":"null"}],"uniqueKey":"vendor_data","typeLabel":"CrowdStrikeEDRVendorData · object | MSDefenderEDRVendorData · object | SentinelOneEDRVendorData · object | null"}},"required":["vendor_id","title","description","assigned_user","vendor_severity","vendor_status","first_event_time","last_event_time","resolved_time","vendor","verdict","pid","process_created_at","process_filename","process_command_line","process_filepath","process_sha1","process_sha256","process_md5","parent_pid","user_name","windows_sid","active_directory_user_id","active_directory_domain","device","mitre"],"title":"ScopedEDRAlertRespModel","type":"object","uniqueKey":"","typeLabel":"ScopedEDRAlertRespModel · object"},"examples":{"Example":{"title":"Example","value":{"active_directory_domain":"\u003cstring>","active_directory_user_id":"\u003cstring>","assigned_user":"\u003cstring>","description":"\u003cstring>","device":{"ad_info":{"device_id":"\u003cstring>","domain":"\u003cstring>","org_unit":"\u003cstring>","site_name":"\u003cstring>"},"first_seen":"2023-11-07T05:31:56Z","id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","installed_software":["\u003cstring>"],"last_seen":"2023-11-07T05:31:56Z","source_vendors":[{"vendor":"\u003cstring>","vendor_id":"\u003cstring>","agent_info":{"agent_version":"\u003cstring>","policies":[{}],"signature_version":"\u003cstring>"}}],"status":"active","cloud_metadata":{"account_id":"\u003cstring>","availability_zone":"\u003cstring>","cloud_provider":"aws","image_id":"\u003cstring>","instance_id":"\u003cstring>","instance_type":"\u003cstring>","kernel_id":"\u003cstring>","region":"\u003cstring>","subnet_id":"\u003cstring>","vpc_id":"\u003cstring>"},"fqdns":["\u003cstring>"],"hostnames":["\u003cstring>"],"identities":[{"username":"\u003cstring>","user_sid":"\u003cstring>"}],"ipv4s":["\u003cstring>"],"ipv6s":["\u003cstring>"],"mac_addresses":["\u003cstring>"],"os_major_version":"\u003cstring>","os_minor_version":"\u003cstring>","os_version":"\u003cstring>","platform":"mac","tags":[{"key":"\u003cstring>","source":"aws","value":"\u003cstring>"}],"vendor_data":{}},"first_event_time":"2023-11-07T05:31:56Z","last_event_time":"2023-11-07T05:31:56Z","mitre":[{"techniques":[{"technique_id":"\u003cstring>","technique_link":"\u003cstring>","technique_name":"\u003cstring>"}],"tactic_id":"\u003cstring>","tactic_name":"\u003cstring>","tactic_source":"\u003cstring>"}],"parent_pid":"\u003cstring>","pid":"\u003cstring>","process_command_line":"\u003cstring>","process_created_at":"2023-11-07T05:31:56Z","process_filename":"\u003cstring>","process_filepath":"\u003cstring>","process_md5":"\u003cstring>","process_sha1":"\u003cstring>","process_sha256":"\u003cstring>","resolved_time":"2023-11-07T05:31:56Z","title":"\u003cstring>","user_name":"\u003cstring>","vendor":"crowdstrike","vendor_id":"\u003cstring>","vendor_severity":"\u003cstring>","vendor_status":"\u003cstring>","verdict":"FALSE_POSITIVE","windows_sid":"\u003cstring>","id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","observables":[{"name":"\u003cstring>","type_id":0,"type":"UNKNOWN","value":"\u003cstring>"}],"severity":"none","status":"unknown","vendor_data":{"aggregate_id":"\u003cstring>","created_at":"2023-11-07T05:31:56Z","falcon_host_link":"\u003cstring>","updated_at":"2023-11-07T05:31:56Z","vendor":"CROWDSTRIKE"}}}},"exampleType":"generated"}},"description":"Successful Response","exampleType":"generated"},"141435af-d2c6-4c7c-80b8-052798dcc6aa":{"content":{"application/json":{"schema":{"properties":{"detail":{"description":"Error message","title":"Detail","type":"string","isRequired":true,"uniqueKey":"detail","typeLabel":"string"}},"required":["detail"],"title":"ErrorException","type":"object","uniqueKey":"","typeLabel":"ErrorException · object"},"examples":{"Example":{"title":"Example","value":{"detail":"\u003cstring>"}}},"exampleType":"generated"}},"description":"EDR alert not found","exampleType":"generated"},"d992c71b-4d0f-4bd0-823b-cf863bc3eec5":{"content":{"application/json":{"schema":{"properties":{"detail":{"items":{"properties":{"loc":{"items":{"oneOf":[{"type":"string","uniqueKey":"detail.items.[INDEX].loc.items.[INDEX].oneOf.0","typeLabel":"string"},{"type":"integer","uniqueKey":"detail.items.[INDEX].loc.items.[INDEX].oneOf.1","typeLabel":"integer"}],"uniqueKey":"detail.items.[INDEX].loc.items.[INDEX]","typeLabel":"string | integer"},"title":"Location","type":"array","isRequired":true,"uniqueKey":"detail.items.[INDEX].loc","typeLabel":"(string | integer)[]"},"msg":{"title":"Message","type":"string","isRequired":true,"uniqueKey":"detail.items.[INDEX].msg","typeLabel":"string"},"type":{"title":"Error Type","type":"string","isRequired":true,"uniqueKey":"detail.items.[INDEX].type","typeLabel":"string"},"ctx":{"title":"Context","type":"object","uniqueKey":"detail.items.[INDEX].ctx","typeLabel":"Context · object"},"input":{"oneOf":[{"title":"Input"}],"uniqueKey":"detail.items.[INDEX].input","typeLabel":"any"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object","uniqueKey":"detail.items.[INDEX]","typeLabel":"ValidationError · object"},"title":"Detail","type":"array","uniqueKey":"detail","typeLabel":"ValidationError · object[]"}},"title":"HTTPValidationError","type":"object","uniqueKey":"","typeLabel":"HTTPValidationError · object"},"examples":{"Example":{"title":"Example","value":{"detail":[{"loc":["\u003cstring>"],"msg":"\u003cstring>","type":"\u003cstring>","ctx":{},"input":"\u003cunknown>"}]}}},"exampleType":"generated"}},"description":"Validation Error","exampleType":"generated"}},"security":{"95ad47f8-fb30-48e0-b978-4430c487a72e":{"API-Key":{"in":"header","name":"X-API-KEY","type":"apiKey","scopes":[],"schemeName":"API-Key"},"Connection-ID":{"in":"header","name":"X-CONNECTION-ID","type":"apiKey","scopes":[],"schemeName":"Connection-ID"}}},"servers":{"f90a6b90-72d5-4b55-b234-2914fbc62d65":{"description":"Production API (US)","url":"https://api.leen.dev/v1"},"3361ee71-d73f-428e-a454-e36776673607":{"description":"Production API (EU)","url":"https://api.eu-c1.leen.dev/v1"},"5e7aafd1-736a-4f52-bc35-6f2fa35bc169":{"description":"Production API (APAC)","url":"https://api.ap-se2.leen.dev/v1"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"in":"header","name":"X-API-KEY","type":"apiKey","scopes":[],"schemeName":"API-Key"},"schema":{"title":"X-API-KEY","type":"string","isRequired":true,"typeLabel":"string","deprecated":false},"schemeName":"API-Key","name":"X-API-KEY"},{"scheme":{"in":"header","name":"X-CONNECTION-ID","type":"apiKey","scopes":[],"schemeName":"Connection-ID"},"schema":{"title":"X-CONNECTION-ID","type":"string","isRequired":true,"typeLabel":"string","deprecated":false},"schemeName":"Connection-ID","name":"X-CONNECTION-ID"}],"title":"API-Key \u0026 Connection-ID"}]},"originalFileLocation":"openapi.json"},"subdomain":"leen","siteName":"Leen.dev Unified API for Security","title":"Get Alert by ID - Leen.dev Unified API for Security","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2025-08-19T14:55:12.911Z","originalFileLocation":"api-reference/edr/get-alert-by-id.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"light\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Retrieve an EDR alert by its ID (Leen\u0026#x27;s UUID).\">\u003cmeta data-mint-head name=\"application-name\" content=\"Leen.dev Unified API for Security\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Get Alert by ID - Leen.dev Unified API for Security\">\u003cmeta data-mint-head property=\"og:description\" content=\"Retrieve an EDR alert by its ID (Leen\u0026#x27;s UUID).\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Leen.dev Unified API for Security\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.leen.dev/api-reference/edr/get-alert-by-id\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://leen.mintlify.app/_mintlify/api/og/v2?division=EDR\u0026amp;title=Get+Alert+by+ID\u0026amp;description=Retrieve+an+EDR+alert+by+its+ID+%28Leen%27s+UUID%29.\u0026amp;theme=b89b0bc9fdd6330beb9cfeda\u0026amp;signature=03d60ebda55910b3da5a323abfed28281027daeff903dabaee4fc367f4c8e02f\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Get Alert by ID - Leen.dev Unified API for Security\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Retrieve an EDR alert by its ID (Leen\u0026#x27;s UUID).\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://leen.mintlify.app/_mintlify/api/og/v2?division=EDR\u0026amp;title=Get+Alert+by+ID\u0026amp;description=Retrieve+an+EDR+alert+by+its+ID+%28Leen%27s+UUID%29.\u0026amp;theme=b89b0bc9fdd6330beb9cfeda\u0026amp;signature=03d60ebda55910b3da5a323abfed28281027daeff903dabaee4fc367f4c8e02f\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/leen/a1H8fw6GLH0gddpy/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Leen.dev Unified API for Security\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#8C43EA\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.leen.dev/api-reference/edr/get-alert-by-id\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/edr/get-alert-by-id.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.leen.dev/#organization\",\"name\":\"Leen.dev Unified API for Security\",\"url\":\"https://docs.leen.dev\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/leen/0MpnNXrQ3mRuduqT/logo/light.svg?fit=max\u0026auto=format\u0026n=0MpnNXrQ3mRuduqT\u0026q=85\u0026s=f622048d909cda879d6dc25b3331a9a8\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.leen.dev#website\",\"name\":\"Leen.dev Unified API for Security\",\"url\":\"https://docs.leen.dev\",\"publisher\":{\"@id\":\"https://docs.leen.dev/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id#webpage\",\"url\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id\",\"name\":\"Get Alert by ID\",\"description\":\"Retrieve an EDR alert by its ID (Leen's UUID).\",\"dateModified\":\"2025-08-19T14:55:12.911Z\",\"isPartOf\":{\"@id\":\"https://docs.leen.dev#website\"},\"breadcrumb\":{\"@id\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"EDR\",\"item\":\"https://docs.leen.dev/api-reference/edr/supported-connectors\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Get Alert by ID\",\"item\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id#apireference\",\"headline\":\"Get Alert by ID\",\"name\":\"Get Alert by ID\",\"description\":\"Retrieve an EDR alert by its ID (Leen's UUID).\",\"url\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id\",\"mainEntityOfPage\":{\"@id\":\"https://docs.leen.dev/api-reference/edr/get-alert-by-id#webpage\"},\"dateModified\":\"2025-08-19T14:55:12.911Z\",\"publisher\":{\"@id\":\"https://docs.leen.dev/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.leen.dev#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Leen.dev Unified API for Security\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Leen.dev Unified API for Security","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":"/intro/introduction"}]},{"tab":"API Reference","groups":[{"group":"API Documentation","pages":[{"title":"Authentication","href":"/api-reference/authentication"},{"title":"Creating a new connection","href":"/api-reference/creating-a-connection"},{"title":"Cursor Pagination","href":"/api-reference/pagination"},{"title":"Connection Health","href":"/api-reference/connection-health"}]},{"group":"AppSec","pages":[{"title":"AppSec Connectors","icon":"grid-2","href":"/api-reference/appsec/supported-connectors"},{"openapi":"get /appsec/issues","title":"List Issues","href":"/api-reference/appsec/get-issues"},{"openapi":"get /appsec/issues/{issue_id}","title":"Get Issue by ID","href":"/api-reference/appsec/get-issue-by-id"}]},{"group":"EDR","pages":[{"title":"EDR Connectors","icon":"grid-2","href":"/api-reference/edr/supported-connectors"},{"openapi":"get /edr/alerts","title":"List Alerts","description":"List all the EDR alerts for a given connection.","href":"/api-reference/edr/get-alerts"},{"openapi":"get /edr/alerts/{alert_id}","title":"Get Alert by ID","href":"/api-reference/edr/get-alert-by-id"},{"openapi":"get /edr/policies","title":"List Policies","description":"List all the device policies for a given connection.","href":"/api-reference/edr/get-policies"}]},{"group":"VMS","pages":[{"title":"VMS Connectors","icon":"grid-2","href":"/api-reference/vms/supported-connectors"},{"openapi":"get /vms/vulnerabilities","title":"List Vulnerabilities","href":"/api-reference/vms/get-vulnerabilities"},{"openapi":"get /vms/vulnerabilities/{vuln_id}","title":"Get Vulnerability by ID","href":"/api-reference/vms/get-vulnerability-by-id"},{"openapi":"get /vms/scan-configurations","title":"List VMS Scan Configurations","href":"/api-reference/vms/get-scan-configurations"},{"openapi":"get /vms/scan-configurations/{scan_config_id}","title":"Get VMS Scan Configuration by ID","href":"/api-reference/vms/get-scan-configuration-by-id"}]},{"group":"CSPM","pages":[{"title":"CSPM Connectors","icon":"grid-2","href":"/api-reference/cspm/supported-connectors"},{"openapi":"get /cspm/alerts","title":"List Alerts","href":"/api-reference/cspm/get-alerts"},{"openapi":"get /cspm/compliance_findings","title":"List Compliance Findings","href":"/api-reference/cspm/get-compliance-findings"},{"openapi":"get /cspm/compliance","title":"List Compliance Data with Conditional Findings","href":"/api-reference/cspm/get-compliance-data"}]},{"group":"Identity Provider (IDP)","pages":[{"title":"IDP Connectors","icon":"grid-2","href":"/api-reference/idp/supported-connector"},{"openapi":"get /idp/users","title":"List IDP Users","href":"/api-reference/idp/list-users"},{"openapi":"get /idp/groups","title":"List IDP Groups","href":"/api-reference/idp/list-groups"},{"openapi":"get /idp/applications","title":"List IDP Applications","href":"/api-reference/idp/list-applications"},{"openapi":"get /idp/alerts","title":"List IDP Alerts","href":"/api-reference/idp/list-alerts"},{"openapi":"get /idp/policies","title":"List IDP Policies","href":"/api-reference/idp/list-policies"},{"openapi":"get /idp/policies/{policy_id}/groups","title":"List Groups for IDP Policy","href":"/api-reference/idp/list-policy-groups"},{"openapi":"get /idp/policies/{policy_id}/applications","title":"List Applications for IDP Policy","href":"/api-reference/idp/list-policy-applications"},{"openapi":"get /idp/policies/{policy_id}/users","title":"List Users for IDP Policy","href":"/api-reference/idp/list-policy-users"}]},{"group":"TPRM","pages":[{"title":"TPRM Connectors","icon":"grid-2","href":"/api-reference/tprm/supported-connectors"},{"group":"Companies","pages":[{"openapi":"get /tprm/companies","title":"List TPRM Companies","href":"/api-reference/tprm/companies/get-companies"},{"openapi":"get /tprm/companies/{company_id}","title":"Get TPRM Company by ID","href":"/api-reference/tprm/companies/get-company-by-id"}]},{"group":"Findings","pages":[{"openapi":"get /tprm/findings","title":"List TPRM Findings","href":"/api-reference/tprm/findings/get-findings"},{"openapi":"get /tprm/findings/{finding_id}","title":"Get TPRM Finding by ID","href":"/api-reference/tprm/findings/get-finding-by-id"}]}]},{"group":"GRC","pages":[{"title":"GRC Connectors","icon":"grid-2","href":"/api-reference/grc/supported-connectors"},{"group":"Entities","pages":[{"openapi":"get /grc/entities","title":"List GRC entities","href":"/api-reference/grc/entities/get-entities"},{"openapi":"get /grc/entities/{entity_id}","title":"Get GRC entity by ID","href":"/api-reference/grc/entities/get-entity-by-id"}]},{"group":"Controls","pages":[{"openapi":"get /grc/controls","title":"List GRC Controls","href":"/api-reference/grc/controls/get-controls"},{"openapi":"get /grc/controls/{control_id}","title":"Get GRC Control","href":"/api-reference/grc/controls/get-control-by-id"}]},{"group":"Assessments","pages":[{"openapi":"get /grc/assessments","title":"List GRC Assessments","href":"/api-reference/grc/assessments/get-assessments"},{"openapi":"get /grc/assessments/{assessment_id}","title":"Get GRC Assessment","href":"/api-reference/grc/assessments/get-assessment-by-id"},{"openapi":"post /grc/assessments/response","title":"Submit GRC Assessment","href":"/api-reference/grc/assessments/post-assessment-response"}]},{"group":"Evidences","pages":[{"openapi":"get /grc/evidences","title":"List GRC Evidences","href":"/api-reference/grc/evidences/get-evidences"}]}]},{"group":"ITSM","pages":[{"title":"ITSM Connectors","icon":"grid-2","href":"/api-reference/itsm/supported-connectors"},{"group":"Tickets","pages":[{"openapi":"post /itsm/tickets","title":"Create ITSM Ticket","href":"/api-reference/itsm/create-ticket"},{"openapi":"get /itsm/tickets","title":"List ITSM Tickets","href":"/api-reference/itsm/get-tickets"},{"openapi":"get /itsm/tickets/{ticket_id}","title":"Get ITSM Ticket by ID","href":"/api-reference/itsm/get-ticket-by-id"},{"openapi":"patch /itsm/tickets/{ticket_id}","title":"Update ITSM Ticket by ID","href":"/api-reference/itsm/update-ticket-by-id"},{"openapi":"get /itsm/tickets/by-identifier/{identifier}","title":"Get ITSM Ticket by Identifier","href":"/api-reference/itsm/get-ticket-by-identifier"},{"openapi":"post /itsm/tickets/bulk","title":"Bulk Create ITSM Tickets (Async)","href":"/api-reference/itsm/create-ticket-bulk"},{"openapi":"post /itsm/tickets/bulk/sync","title":"Bulk Create ITSM Tickets (Sync)","href":"/api-reference/itsm/create-ticket-bulk-sync"},{"openapi":"post /itsm/tickets/bulk/update","title":"Bulk Update ITSM Tickets (Async)","href":"/api-reference/itsm/update-ticket-bulk"}]},{"group":"Projects","pages":[{"openapi":"get /itsm/projects","title":"List ITSM Projects","href":"/api-reference/itsm/get-projects"},{"openapi":"get /itsm/projects/{project_id}","title":"Get ITSM Project by ID","href":"/api-reference/itsm/get-project-by-id"}]},{"group":"Comments","pages":[{"openapi":"get /itsm/comments","title":"List ITSM Comments","href":"/api-reference/itsm/get-comments"},{"openapi":"get /itsm/comments/{comment_id}","title":"Get ITSM Comment by ID","href":"/api-reference/itsm/get-comment-by-id"}]},{"group":"Attachments","pages":[{"openapi":"get /itsm/attachments","title":"List ITSM Attachments","href":"/api-reference/itsm/get-attachments"},{"openapi":"get /itsm/attachments/{attachment_id}","title":"Get ITSM Attachment by ID","href":"/api-reference/itsm/get-attachment-by-id"}]},{"group":"Users","pages":[{"openapi":"get /itsm/users","title":"List ITSM Users","href":"/api-reference/itsm/get-users"},{"openapi":"get /itsm/users/{user_id}","title":"Get ITSM User by ID","href":"/api-reference/itsm/get-user-by-id"}]},{"group":"Groups","pages":[{"openapi":"get /itsm/groups","title":"List ITSM Groups","href":"/api-reference/itsm/get-groups"},{"openapi":"get /itsm/groups/{group_id}","title":"Get ITSM Group by ID","href":"/api-reference/itsm/get-group-by-id"}]},{"group":"Passthrough","pages":[{"openapi":"get /itsm/passthrough/projects","title":"List Projects (Passthrough)","href":"/api-reference/itsm/passthrough-projects"},{"openapi":"get /itsm/passthrough/projects/{project_key}/issue-types","title":"List Issue Types for a Project (Passthrough)","href":"/api-reference/itsm/passthrough-issue-types"},{"openapi":"get /itsm/passthrough/tickets/search","title":"Search Tickets (Passthrough)","href":"/api-reference/itsm/passthrough-tickets-search"},{"openapi":"get /itsm/passthrough/projects/{project_key}/assignable-users","title":"List Assignable Users for a Project (Passthrough)","href":"/api-reference/itsm/passthrough-assignable-users"}]}]},{"group":"Entities","pages":[{"title":"Device Connectors","icon":"grid-2","href":"/api-reference/entities/supported-connectors"},{"openapi":"get /entities/devices","title":"List Devices","href":"/api-reference/entities/get-devices"},{"openapi":"get /entities/devices/{device_id}","title":"Get Device by ID","href":"/api-reference/entities/get-device-by-id"},{"openapi":"get /entities/device-groups","title":"List Device Groups","href":"/api-reference/entities/get-device-groups"}]},{"group":"Configuration","pages":[{"title":"Configuration Connectors","icon":"grid-2","href":"/api-reference/configuration/supported-connectors"},{"openapi":"get /configuration/users","title":"List Configuration Users","href":"/api-reference/configuration/get-configuration-users"},{"openapi":"get /configuration/users/{user_id}","title":"Get Configuration User by ID","href":"/api-reference/configuration/get-configuration-user-by-id"}]},{"group":"Provisioning","pages":[{"openapi":"post /provisioning/organizations","title":"Create Organization","href":"/api-reference/provisioning/add-organization"},{"openapi":"get /provisioning/organizations","title":"List Organizations","href":"/api-reference/provisioning/list-organizations"},{"openapi":"get /provisioning/organizations/{organization_id}","title":"Get Organization by ID","href":"/api-reference/provisioning/get-organization"},{"openapi":"delete /provisioning/organizations/{organization_id}","title":"Delete Organization by ID","href":"/api-reference/provisioning/delete-organization"},{"openapi":"post /provisioning/organizations/{organization_id}/connections","title":"Create Connection","href":"/api-reference/provisioning/add-new-connection"},{"openapi":"get /provisioning/organizations/{organization_id}/connections","title":"List Connections","href":"/api-reference/provisioning/list-connections"},{"openapi":"get /provisioning/organizations/{organization_id}/connections/{connection_id}","title":"Get Connection by ID","href":"/api-reference/provisioning/get-connection"},{"openapi":"get /provisioning/organizations/{organization_id}/connections/{connection_id}/jobs","title":"List Jobs by Connection ID","href":"/api-reference/provisioning/get-connection-jobs"},{"openapi":"get /provisioning/organizations/{organization_id}/connections/{connection_id}/test","title":"Test Connection Credentials by Connection ID","href":"/api-reference/provisioning/test-connection"},{"openapi":"delete /provisioning/organizations/{organization_id}/connections/{connection_id}","title":"Delete Connection","href":"/api-reference/provisioning/delete-connection"},{"openapi":"patch /provisioning/organizations/{organization_id}/connections/{connection_id}","title":"Update Connection by ID and Organization ID","href":"/api-reference/provisioning/update-connection"}]},{"group":"Connectors","pages":[{"openapi":"get /connectors","title":"Get Integrations","href":"/api-reference/connectors"}]},{"group":"Integration Details","pages":[{"title":"List Integration Details","openapi":"get /integrations/","href":"/api-reference/integration-details/list-integration-details"},{"title":"Get Integration Details by ID","openapi":"get /integrations/{id}","href":"/api-reference/integration-details/get-integration-details-by-id"}]},{"group":"OnRamp","pages":[{"openapi":"post /provisioning/organizations/{organization_id}/connection-invite-tokens","title":"Create Connection Invite Token","href":"/api-reference/onramp/create-connection-invite-token"},{"openapi":"get /provisioning/organizations/{organization_id}/connection-invite-tokens","title":"List Connection Invite Tokens","href":"/api-reference/onramp/get-connection-invite-tokens"}]},{"group":"Enrichments","pages":[{"openapi":"get /enrichments/nvd","title":"Get NVD Enrichment Data for CVEs","href":"/api-reference/enrichments/nvd"}]},{"group":"Outbound Jobs","pages":[{"openapi":"get /outbound-jobs/{job_id}","title":"Get Outbound job by id","href":"/api-reference/outbound-job"}]}]},{"tab":"(BETA) API Reference V2","pages":[{"title":"(BETA) API Reference V2","href":"/api-reference-v2/supported-connectors"}]}]},"basePath":"","title":"Get Alert by ID - Leen.dev Unified API for Security","buildId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","deploymentId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-CS552b7R.js","utils-DDTCYAF2.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-De8ttokP.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-DrwRDvAh.js","snippetPresets-DtAN0nWx.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-D5rWArI6.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-O2i12wsz.js","shallow-DV8xABTt.js","getApiPlaygroundDisplay-DBZ0B5Jx.js","CodeSnippet-BVi0tPUX.js","CodeSnippets-CqASbIwY.js","Page-m07pfKpT.js","getPastedJson-DG9vsMS8.js","icon-CXzRSCr8.js","MethodPill-BdKVtEuX.js","DuplicateIcon-CZlmBrJI.js","createIcon-biFEUKPL.js","DynamicMarkdown-B54_zNBF.js","SectionHeading-DwwHK3Pt.js","axios-vUo_bRtp.js","Markdown-DfhCTwyA.js","clsx-xpJZXxdP.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BTZUMDnx.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-DqdKa2R4.js"]}