List details of notifications for a container where 21 is the container ID in the example request below, but not the ID in the example responses below.
Example request
List details of notifications.
curl -k -u uname:pwd https://localhost/rest/notification/21/detail_summary_view -G -X GET
Example response
A successful GET for approval notification type will return a 200 response, and a JSON formatted list of details.
{
"update_time": "2019-08-19T21:43:58.892936Z",
"container_id": 291,
"time_left": 80128.535132,
"next_owner": null,
"action_name": "user initiated post ip action",
"due_time": "2019-08-20T20:05:57.814000Z",
"asset": {
"action_whitelist": {},
"validation": {},
"tenants": [],
"description": "Default Asset Configuration for AbuseIPDB",
"tags": [],
"type": "reputation",
"primary_voting": 0,
"product_version": "",
"effective_user": 2,
"product_name": "AbuseIPDB",
"disabled": false,
"token": null,
"version": 1,
"secondary_voting": 0,
"configuration": {
"api_key": "<encrypted_key>"
},
"product_vendor": "AbuseIPDB",
"id": 70,
"name": "abuse_ip_db"
},
"action_type": "post ip",
"container_name": "Possible Malicious Email",
"owner": "admin",
"notification_type": "approval",
"type": "asset",
"notification_targets": [{
"app_id": 152,
"parameters": [{
"comment": "Possibly malicious IP address",
"ip": "1.2.3.4",
"categories": "phishing"
}],
"assets": [
70
]
}]
}
Example response
A successful GET for prompt notification type will return a 200 response, and a JSON formatted list of details.
{
"playbook_repo": "local",
"update_time": "2019-09-05T23:06:14.828588Z",
"playbook_name": "Detect Malicious Domains",
"container_id": 6355,
"time_left": null,
"next_owner": null,
"action_name": "prompt_1",
"container_name": "Malicious URL Request Attempt",
"owner": "admin",
"notification_type": "prompt",
"escalated_approval": null,
"due_time": "2019-09-05T23:06:14.709000Z",
"jitc": {},
"asset": null,
"action_type": "prompt",
"type": "manual",
"notification_targets": [{
"app_id": 0,
"parameters": [{
"to": "admin@example.com",
"message": "Malicious domain detected",
"mins_to_act": 30,
"user_ids": [1],
"response_types": [{
"prompt": "General comments on domain",
"options": {
"type": "message"
}
}, {
"prompt": "Have any users visited this malicious address?",
"options": {
"type": "list",
"choices": ["Yes", "No"]
}
}]
}],
"assets": []
}]
}
Example response
A successful GET for manualtask notification type will return a 200 response, and a JSON formatted list of details.
{
"update_time": "2019-09-05T01:34:58.002459Z",
"container_id": 6325,
"time_left": null,
"next_owner": null,
"action_name": "user initiated task",
"container_name": "Possible Malicious Email",
"owner": "admin",
"notification_type": "manualtask",
"escalated_approval": null,
"due_time": "2019-09-05T01:34:57.833000Z",
"jitc": {},
"asset": null,
"action_type": "task",
"type": "manual",
"notification_targets": []
}
Example response
A successful GET for actionreview notification type will return a 200 response, and a JSON formatted list of details.
{
"playbook_repo": "local",
"update_time": "2019-09-05T20:27:15.311964Z",
"playbook_name": "Detect and Respond Against Malicious Domains",
"container_id": 6354,
"time_left": 32711.14501,
"next_owner": null,
"action_name": "block_ip",
"container_name": "ASN Transaction",
"owner": "admin",
"notification_type": "actionreview",
"escalated_approval": null,
"due_time": "2019-09-06T08:27:15.301000Z",
"jitc": {},
"asset": null,
"action_type": "block ip",
"type": "parameter",
"notification_targets": [{
"app_id": 124,
"parameters": [{
"is_source_address": "",
"ip": "1.1.1.1"
}],
"assets": [170]
}]
}
The return values of note follow:
| Field
|
Type
|
Description
|
| asset |
JSON Object |
Can be empty depending on the notification type and if it contains an asset. See REST Assets for further information about assets.
|
| container_id |
String |
The container Id of the playbook action run.
|
| due_time |
String |
Time (UTC) when this action is due ( time at which the SLA expires/expired ).
|
| next_owner |
String |
The next owner for an approval, such as admin.
|
| notification_targets |
JSON Object |
JSON object containing a variety of parameters entered in response to prompt.
|
| notification_type |
String |
prompt, approval, manualtask, actionreview.
|
| owner |
String |
The current owner's display name, such as admin.
|
| playbook_name |
String |
The playbook name.
|
| playbook_repo |
String |
The name of the the playbook repository.
|
| prompt |
String |
The options available to respond to a prompt such as:
list: a list of pre-selected strings
message: a user-inputted string
range: a number in the range specified by the prompt response
It returns a dictionary that organizes the response answer percentage by response.
|
| time_left |
String |
The due time minus the current time, in seconds.
|
| type |
String |
Mapping for prettifying notification types, such as:
|
Download manual
Feedback submitted, thanks!