List threats

POST 
/mt/monitor/v1/agg/threats/list

Retrieve an aggregated list of all threats across tenants.

Request

Query Parameters

agg_by string
Must be tenant. Using the query parameter returns all the aggregated responses for the current parent tenant and its child tenants. If not used, the results for just the current tenant are returned.
Example: tenant

Header Parameters

X-PANW-Region string
Must be one of the following: de, americas, europe, uk, sg, ca, jp, au, in. Returns details from the Cortex Data Lake (CDL) region specified. If no region is specified, the default response is americas CDL region.
Example: americas

application/json

Body

filter objectrequired
filter json object
operator stringrequired
Always set to AND
rules object[]
anyOf
ThreatRule
Array [
operator string
Filter operator that is one of the example values and is run on the property field
property string
Filter property field that is one of the example values
values string[]
Filter property value
]
TimeFilter
Array [
operator string
Filter operator that is one of the example values and is run on the property field
property string
Filter property field that is one of the example values
values string[]
Filter property value
]
properties object[]required
List of property json objects
Array [
alias string
property string
Property field name. Property fields will be returned in the API response.
sort object
order string
Sort Order for the property
]

Responses

200

Success

application/json

Schema

Schema

any

Threat List

[
  {
    "blocked_count": 10,
    "malicious_count": 10,
    "sub_tenant_id": "<sub_tenant_id>",
    "total_threats": 10,
    "unblocked_count": 10,
    "unknown_count": 10
  }
]

400

Bad Request

500

Server Error

Loading...