Get Alert or Vulnerability Capabilities

Listing the current IoT capabilities on alert and vulnerability

Query Parameters

customerid string required

The customer ID to which the API call is directed

type string required

Possible values: [alert, vulnerability, all]

The type of IoT supported capabilities

Responses

• 200
• 4XX
• 5XX

---

Successful Response (We only show some important fields here.)

application/json

Schema

Example (from schema)

securityAlertsResponseExample

vulnerabilityResponseExample

---

Schema

ver string required

The API version

api string required

The API path

total integer required

The total number of capabilities

list object[] required
An array of alert capabilities
Array [
name string
The name of the alert/vulnerability
description string
The descriptoin of this alert/vulnerability
source string
The source of this alert/vulnerability
severity string
The severity of this alert/vulnerability
type string
The type of the alert/vulnerability
]

{
  "ver": "string",
  "api": "string",
  "total": 0,
  "list": [
    {
      "name": "string",
      "description": "string",
      "source": "string",
      "severity": "string",
      "type": "string"
    }
  ]
}

{
  "api": "alertVulnCapability/getList",
  "ver": "v4.0",
  "list": [
    {
      "name": "Suspicious port scanning activity",
      "description": "Detected suspicious outbound port scanning activities. A port scan can be used to discover available application or networking services. A wide range port scan is not normal. It is often used by an attacker or a malware to discover target services with vulnerabilities.",
      "type": "scanner",
      "severity": "medium",
      "source": "iot security"
    },
    {
      "name": "Potential port scanning activity",
      "description": "Detected suspicious outbound port scanning activities. A port scan can be used to discover available application or networking services. A software initiated wide range port scan is not normal. It is often used by an attacker or a malware to discover target services with vulnerabilities.",
      "type": "scanner",
      "severity": "medium",
      "source": "iot security"
    }
  ],
  "total": 2
}

{
  "api": "alertVulnCapability/getList",
  "ver": "v4.0",
  "list": [
    {
      "name": "Windows SMB v1 Usage",
      "description": "SMB (Server Message Block) is a protocol for sharing files. It allows a device to locate files on other devices running SMB and open, read, write to, and delete those files. There are various implementations of SMB such as Microsoft SMB and Samba. Samba provides file and print services and can integrate with a Microsoft Windows Server domain. Unfortunately, some versions of Microsoft Windows and Samba Servers running SMB v1 are vulnerable to attack because they can allow attackers to obtain sensitive information from them and launch various exploits. As a result, the use of SMB v1 on devices running Microsoft Windows or Linux is considered a security risk.",
      "impact": "By exploiting SMB v1 vulnerabilities, an attacker can access information, run arbitrary code, launch attacks such as man-in-the-middle and denial-of-service, and install malware such as EternalBlue, WannaCry, and Conficker on the compromised system. From there, the malware can spread to other computers with which the victim interacts online. Palo Alto Networks IoT Security Team recommends that you evaluate the impact of these vulnerabilities based on their operational environment and specific clinical usage.",
      "source": "IoT Security",
      "severity": "High"
    },
    {
      "name": "CVE-2013-7404",
      "impact": "Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.\n\nImpact to individual organizations depends on many factors that are unique to each organization. NCCIC recommends that organizations evaluate the impact of this vulnerability based on their operational environment and specific clinical usage.",
      "source": "IoT Security",
      "description": "GE Healthcare Discovery NM 750b has a password of 2getin for the insite account for (1) Telnet and (2) FTP, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.",
      "severity": "High"
    }
  ],
  "total": 2
}

Client Error Response

application/json

Schema

Example (from schema)

Bad Request

Forbidden access

Too many requests

---

Schema

code string

STATUS_CODE

msg string

GENERAL_MESSAGE

{
  "code": "string",
  "msg": "string"
}

{
  "code": 400,
  "msg": "Bad Request. This occurs when an HTTP request contains an invalid query string."
}

{
  "code": 403,
  "msg": "Forbidden access. Either the provided API key is invalid or it does not have the required RBAC permissions to run this API."
}

{
  "code": 429,
  "msg": "Too many requests. The number of requests for device details for a single device exceeded the rate limit of 180 queries per minute per tenant."
}

Server Error Response

application/json

Schema

Example (from schema)

securityAlertsResponseExample

---

Schema

code string

STATUS_CODE

msg string

GENERAL_MESSAGE

{
  "code": "string",
  "msg": "string"
}

{
  "code": 500,
  "msg": "Internal server error. A unified status for API communication type errors."
}

Loading...