Fetch Incident Events Using Scroll APIs

GET/ioc/events/scroll

Input ParametersInput Parameters

Input Parameters	Mandatory/Optional	Description
fromDate (String)	Optional	Show events logged after a certain date. Supports epoch time / unix timestamp. See https://en.wikipedia.org/wiki/Unix_time For example - 1483228800 Note: This parameter is used in conjunction with the "toDate" parameter to fetch events for a specific date. Time value is not considered in this parameter. Use the filter parameter to drill down further by applying the time value.
toDate (String)	Optional	Show events logged until a certain date. Supports epoch time / unix timestamp. See https://en.wikipedia.org/wiki/Unix_time For example - 1514764799 Note: This parameter is used in conjunction with the "fromDate" parameter to fetch events for a specific date. Time value is not considered in this parameter. Use the filter parameter to drill down further by applying the time value.
filter (String)	Optional	Filter the events list by providing a query using Qualys syntax. Refer to the “How to Search” topic in the online help for assistance with creating your query. For example - event.dateTime : ['2017-01-01T05:33:34' .. '2017-01- 31T05:33:34'] AND action: 'Created' You can filter events based on the time they are generated on the asset (event.dateTime) or based on the time they are processed at Qualys (event.eventProcessedTime). It is recommended to use the "event.dateTime" or "event.eventProcessedTime" parameter if you want to fetch events by date AND time.
goupBy (String)	Optional	Group results based on certain parameters (provide comma separated list). For example - agentId
sort (String)	Optional	Sort the results using a Qualys token. For example - [{"action":"asc"}]
include_attributes (String)	Optional	Include certain attributes in search (provide comma-separated list). Only included attributes are fetched in the API response. For example,include_attributes = _type, _id, processName
exclude_attributes (String)	Optional	Exclude certain attributes from search (provide comma separated list). For example, exclude_attributes = _type, _id, processName Note: You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Not-included attributes are excluded by default.
scrollId (String)	Optional	Identifier for the search. It retrieves the next batch of search results for the request. For example - scrollId=<scroll_id > Note: This parameter is only for the Next API Request and onwards. We will get scroll_id from the header of the new request.
Authorization (String)	Mandatory	Authorization token to authenticate to the Qualys Cloud Platform. Prepend token with "Bearer" and one space. For example - Bearer authToken.

SampleSample

API request

    curl --location --request GET 
"<qualys_base_url>/ioc/incidents/scroll?filter=(incident.files>0) and incdient.process>0 
--header "Authorization: Bearer <token>"

Response

  
   [
        {
  "hostName": "xxx-xx-xxx-xxxx",
"agentId": "xxx5f0c4-xxxa-xxx1-xxx4-xxxee204bxxx",
"malwareFamilies": [
"Generic",
"fam_trojan"
],
"sha256": "xxx488fcca1c206xxxxxxxxx82308dab03c5ff0ebf605f9d2xxxx",
"techniqueNames": [
"Command and Scripting Interpreter: Windows Command Shell",
"Signed Binary Proxy Execution: Regsvr32"
],
"malwareCategories": [
"Trojan",
"trojan"
],
"fileEventCount": 3,
"operatingSystem": "Microsoft Windows 10 Pro 10.0.17763 Build
17763",
"detectedOn": "2022-07-14T22:00:10.745+0000",
"scoreSource": "SIDDHI",
"mutexEventCount": 0,
"customerId": "xxxcade1-xxx5-xxx1-xxx3-xxx08f55bxxx",
"techniqueIds": [
"Txxxx.0x0",
"Txxxx.xx3"
],
"riskScore": 8,
"id": "xxx7aed0-xxx7-xxx6-xxxe-xxxed62128a4",
"behavior": 0,
"networkEventCount": 0,
"registryEventCount": 0,
"softwareNames": [
"cmd"
],
"mitreRuleNames": [
"T1059_003_1",
"T1218_010_2"
],
"tacticIds": [
"TA0005",
"TA0002"
],
"updatedOn": "2022-07-14T22:03:14.586+0000",
"eventTypes": [
"PROCESS",
"FILE"
],
"incidentId": "xxx7aed0-xxx7-xxx6-xxxe-xxxed6212xxx",
"exploit": 0,
"incidentDescription": "fam_trojan",
"processEventCount": 1
},
{
"hostName": "xxx-xx-xxx-xxxx",
"agentId": "xxx5f0c4-xxxa-xxx1-xxx4-xxxee204bxxx",
"malwareFamilies": [
"Generic",
"fam_trojan"
],
"sha256": "xxxcb4081f34xxx669a65x3653f63fce0b8b4xxxb018772fddxxx",
"techniqueNames": [
"Command and Scripting Interpreter: Windows Command Shell",
"Signed Binary Proxy Execution: Regsvr32"
],
"malwareCategories": [
"Trojan",
"trojan"
],
"fileEventCount": 4,
"operatingSystem": "Microsoft Windows 10 Pro Build 17763",
"detectedOn": "2022-07-15T04:00:13.040+0000",
"scoreSource": "SIDDHI",
"mutexEventCount": 0,
"customerId": "xxxcade1-xxx5-xxx1-xxx3-xxx08f55bxxx",
"techniqueIds": [
"T1218.010",
"T1059.003"
],
"riskScore": 8,
"id": "xxx49269-xxx7-xxx9-xxxf-xxx3a9b30xxx",
"behavior": 0,
"networkEventCount": 0,
"registryEventCount": 0,
"softwareNames": [
"cmd"
],
"mitreRuleNames": [
"T1059_003_1",
"T1218_010_2"
],
"tacticIds": [
"TA0005",
"TA0002"
],
"updatedOn": "2022-07-15T04:04:12.134+0000",
"eventTypes": [
"PROCESS",
"FILE"
],
"incidentId": "xxx49269-xxx7-xxx9-xxxf-xxx3a9b30xxx",
"exploit": 0,
"incidentDescription": "Generic",
"processEventCount": 1
}
]

Next API request

curl --location --request GET "<qualys_base_url>/ioc/incidents/scroll?scrollId=<scroll_id> --header "Authorization: Bearer <token>"

Response

  
    [
        {
   "hostName": "xxxxxxx.xxx.xxx.xxxx.qualys.com",
  "agentId": "xxxf627e-xxx3-xxxc-xxx3-xxx863c3fxxx",
"sha256":
"xxxxxxb076caa8xxxxx922xxxxdeec0542xxxxx6a2e53aa968055fxxx",
"techniqueNames": [
"System Information Discovery",
"Ingress Tool Transfer"
],
"fileEventCount": 11,
"operatingSystem": "CentOS Linux 7.9.2009",
"detectedOn": "2022-10-01T08:45:01.000+0000",
"scoreSource": "SIDDHI",
"mutexEventCount": 0,
"customerId": "xxxcade1-xxx5-xxx1-xxx3-xxx08f55bxxx",
"techniqueIds": [
"T1082",
"T1105"
],
"riskScore": 5,
"id": "xxx227f4-xxxf-xxxa-xxx9-xxx99b9c5xxx",
"behavior": 0,
"networkEventCount": 0,
"registryEventCount": 0,
"mitreRuleNames": [
"AK1001",
"AK1002"
],
"tacticIds": [
"TA0007",
"TA0011"
],
"updatedOn": "2022-10-01T08:49:44.008+0000",
"eventTypes": [
"PROCESS",
"FILE"
],
"tacticNames": [
"Command and Control"
],
"incidentId": "xxx227f4-xxxf-xxxa-xxx9-xxx99b9c5xxx",
"exploit": 0,
"processEventCount": 4
},
{
"hostName": "xxxxxxxx.xxx.xxx.xxxx.qualys.com",
"agentId": "xxxf627e-xxx3-xxxc-xxx3-xxx863c3fxxx",
"sha256":
"xxxxx376xxx65a48527b52ca23xxxx825c54dff1xxxf01exxxxxx1161",
"techniqueNames": [
"System Information Discovery",
"Ingress Tool Transfer"
],
"fileEventCount": 1,
"operatingSystem": "CentOS Linux 7.9.2009",
"detectedOn": "2022-10-01T09:15:02.000+0000",
"scoreSource": "SIDDHI",
"mutexEventCount": 0,
"customerId": "xxxcade1-xxx5-xxx1-xxx3-xxx08f55bxxx",
"techniqueIds": [
"T1082",
"T1105"
],
"riskScore": 5,
"id": "xxx4aca-8xxd-8669-3xxx6bxx2xx0",
"behavior": 0,
"networkEventCount": 0,
"registryEventCount": 0,
"mitreRuleNames": [
"AK1001",
"AK1002"
],
"tacticIds": [
"TA0007",
"TA0011"
],
"updatedOn": "2022-10-01T09:20:02.659+0000",
"eventTypes": [
"PROCESS",
"FILE"
],
"tacticNames": [
"Command and Control"
],
"incidentId": "xxxb4aca-xxxf-xxxd-xxx9-xxx6b5452xxx",
"exploit": 0,
"processEventCount": 6
}
]