List Alerts
curl --request GET \
--url https://api.leen.dev/v1/edr/alerts \
--header 'X-API-KEY: <api-key>' \
--header 'X-CONNECTION-ID: <api-key>'import requests
url = "https://api.leen.dev/v1/edr/alerts"
headers = {
"X-CONNECTION-ID": "<api-key>",
"X-API-KEY": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {
method: 'GET',
headers: {'X-CONNECTION-ID': '<api-key>', 'X-API-KEY': '<api-key>'}
};
fetch('https://api.leen.dev/v1/edr/alerts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.leen.dev/v1/edr/alerts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>",
"X-CONNECTION-ID: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.leen.dev/v1/edr/alerts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-CONNECTION-ID", "<api-key>")
req.Header.Add("X-API-KEY", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.leen.dev/v1/edr/alerts")
.header("X-CONNECTION-ID", "<api-key>")
.header("X-API-KEY", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.leen.dev/v1/edr/alerts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-CONNECTION-ID"] = '<api-key>'
request["X-API-KEY"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"count": 123,
"items": [
{
"vendor_id": "<string>",
"title": "<string>",
"description": "<string>",
"assigned_user": "<string>",
"vendor_severity": "<string>",
"vendor_status": "<string>",
"first_event_time": "2023-11-07T05:31:56Z",
"last_event_time": "2023-11-07T05:31:56Z",
"resolved_time": "2023-11-07T05:31:56Z",
"pid": "<string>",
"process_created_at": "2023-11-07T05:31:56Z",
"process_filename": "<string>",
"process_command_line": "<string>",
"process_filepath": "<string>",
"process_sha1": "<string>",
"process_sha256": "<string>",
"process_md5": "<string>",
"parent_pid": "<string>",
"user_name": "<string>",
"windows_sid": "<string>",
"active_directory_user_id": "<string>",
"active_directory_domain": "<string>",
"device": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_seen": "2023-11-07T05:31:56Z",
"first_seen": "2023-11-07T05:31:56Z",
"source_vendors": [
{
"vendor": "<string>",
"vendor_id": "<string>",
"agent_info": {
"agent_version": "<string>",
"signature_version": "<string>",
"policies": [
{}
]
}
}
],
"installed_software": [
"<string>"
],
"ad_info": {
"org_unit": "<string>",
"site_name": "<string>",
"domain": "<string>",
"device_id": "<string>"
},
"hostnames": [
"<string>"
],
"os_version": "<string>",
"os_major_version": "<string>",
"os_minor_version": "<string>",
"fqdns": [
"<string>"
],
"ipv4s": [
"<string>"
],
"ipv6s": [
"<string>"
],
"mac_addresses": [
"<string>"
],
"cloud_metadata": {
"cloud_provider": "aws",
"account_id": "<string>",
"region": "<string>",
"availability_zone": "<string>",
"instance_id": "<string>",
"instance_type": "<string>",
"image_id": "<string>",
"kernel_id": "<string>",
"vpc_id": "<string>",
"subnet_id": "<string>"
},
"tags": [
{
"key": "<string>",
"value": "<string>"
}
],
"identities": [
{
"username": "<string>",
"user_sid": "<string>"
}
],
"vendor_data": {}
},
"mitre": [
{
"techniques": [
{
"technique_name": "<string>",
"technique_id": "<string>",
"technique_link": "<string>"
}
],
"tactic_name": "<string>",
"tactic_id": "<string>",
"tactic_source": "<string>"
}
],
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"severity": "none",
"status": "unknown",
"observables": [
{
"name": "<string>",
"value": "<string>"
}
],
"vendor_data": {
"aggregate_id": "<string>",
"vendor": "CROWDSTRIKE",
"falcon_host_link": "<string>"
}
}
],
"total": 123
}{
"type": "<string>",
"code": "<string>",
"message": "<string>",
"detail": [
{}
]
}{
"detail": "<string>"
}EDR
List Alerts
List all the EDR alerts for a given connection.
GET
/
edr
/
alerts
List Alerts
curl --request GET \
--url https://api.leen.dev/v1/edr/alerts \
--header 'X-API-KEY: <api-key>' \
--header 'X-CONNECTION-ID: <api-key>'import requests
url = "https://api.leen.dev/v1/edr/alerts"
headers = {
"X-CONNECTION-ID": "<api-key>",
"X-API-KEY": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {
method: 'GET',
headers: {'X-CONNECTION-ID': '<api-key>', 'X-API-KEY': '<api-key>'}
};
fetch('https://api.leen.dev/v1/edr/alerts', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.leen.dev/v1/edr/alerts",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>",
"X-CONNECTION-ID: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.leen.dev/v1/edr/alerts"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-CONNECTION-ID", "<api-key>")
req.Header.Add("X-API-KEY", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.leen.dev/v1/edr/alerts")
.header("X-CONNECTION-ID", "<api-key>")
.header("X-API-KEY", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.leen.dev/v1/edr/alerts")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-CONNECTION-ID"] = '<api-key>'
request["X-API-KEY"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"count": 123,
"items": [
{
"vendor_id": "<string>",
"title": "<string>",
"description": "<string>",
"assigned_user": "<string>",
"vendor_severity": "<string>",
"vendor_status": "<string>",
"first_event_time": "2023-11-07T05:31:56Z",
"last_event_time": "2023-11-07T05:31:56Z",
"resolved_time": "2023-11-07T05:31:56Z",
"pid": "<string>",
"process_created_at": "2023-11-07T05:31:56Z",
"process_filename": "<string>",
"process_command_line": "<string>",
"process_filepath": "<string>",
"process_sha1": "<string>",
"process_sha256": "<string>",
"process_md5": "<string>",
"parent_pid": "<string>",
"user_name": "<string>",
"windows_sid": "<string>",
"active_directory_user_id": "<string>",
"active_directory_domain": "<string>",
"device": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_seen": "2023-11-07T05:31:56Z",
"first_seen": "2023-11-07T05:31:56Z",
"source_vendors": [
{
"vendor": "<string>",
"vendor_id": "<string>",
"agent_info": {
"agent_version": "<string>",
"signature_version": "<string>",
"policies": [
{}
]
}
}
],
"installed_software": [
"<string>"
],
"ad_info": {
"org_unit": "<string>",
"site_name": "<string>",
"domain": "<string>",
"device_id": "<string>"
},
"hostnames": [
"<string>"
],
"os_version": "<string>",
"os_major_version": "<string>",
"os_minor_version": "<string>",
"fqdns": [
"<string>"
],
"ipv4s": [
"<string>"
],
"ipv6s": [
"<string>"
],
"mac_addresses": [
"<string>"
],
"cloud_metadata": {
"cloud_provider": "aws",
"account_id": "<string>",
"region": "<string>",
"availability_zone": "<string>",
"instance_id": "<string>",
"instance_type": "<string>",
"image_id": "<string>",
"kernel_id": "<string>",
"vpc_id": "<string>",
"subnet_id": "<string>"
},
"tags": [
{
"key": "<string>",
"value": "<string>"
}
],
"identities": [
{
"username": "<string>",
"user_sid": "<string>"
}
],
"vendor_data": {}
},
"mitre": [
{
"techniques": [
{
"technique_name": "<string>",
"technique_id": "<string>",
"technique_link": "<string>"
}
],
"tactic_name": "<string>",
"tactic_id": "<string>",
"tactic_source": "<string>"
}
],
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"severity": "none",
"status": "unknown",
"observables": [
{
"name": "<string>",
"value": "<string>"
}
],
"vendor_data": {
"aggregate_id": "<string>",
"vendor": "CROWDSTRIKE",
"falcon_host_link": "<string>"
}
}
],
"total": 123
}{
"type": "<string>",
"code": "<string>",
"message": "<string>",
"detail": [
{}
]
}{
"detail": "<string>"
}Query Parameters
Sort by field
Pattern:
^severity$|^severity\:asc$|^severity\:desc$Enable cursor based pagination instead of default offset-based pagination
Datetime filter, only return items updated since this datetime. Example format: 2021-01-01T00:00:00+00:00
Limit size (page size)
Required range:
x >= 0Offset index (starting index of page)
Required range:
x >= 0Skips returning the total rows, total is set to null when true
Skip token to continue from the last item in the previous page
Include device groups in the devices attached to the vulnerability
Include observable data in the response
Response
Successful Response
- OffsetPaginatedResponse[ScopedEDRAlertRespModel]
- KeySetPaginatedResponse[ScopedEDRAlertRespModel]
⌘I