Get Ignored Events Counts API

Use this API to get the number of ignored events logged.

POST/fim/v2/events/ignore/count

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description

filter 

 Optional  String

Filter the events list by providing a query using Qualys syntax. Refer to the “How to Search” topic in the online help for assistance with creating your query.

For example - dateTime:['2019-02-25T18:30:00.000Z'..'2019-02-26T18:29:59.999Z'] AND action: 'Content'

You can filter events based on the time they are generated on the asset (dateTime) or based on the time they are processed at Qualys (processedTime).

  • For the dateTime filter start date should not be lower than 2017-01-01.
  • The processedTime filter can be used only for events generated post FIM release 2.0.2.
  • To comply with data retention policy, the API fetches data only from the last 15 months. For more information, refer to Data Retention Policy.
groupBy  Optional  String

Group results based on certain parameters (provide comma separated list).

For example - action

limit  Optional  String Limit the number of rows fetched by the groupBy function.

sort 

 Optional  String Sort the results using a Qualys token. For example - [{\"dateTime\":\"asc\"}]
interval Optional String

GroupBy interval for date fields. Valid values are y(year), q(quarter), M(month), w(week), d(day), h(hour), m(minute), s(second). For example - 1d

An interval lower than a second is not supported.

Note: Value for each interval period should be 1. For example, you can specify an interval of 1y, 1M, 1w, and so on, but not 2y, 3M, etc

file.attribute.hidden Optional String Displays attribute event for file or directory for which hidden attribute is checked or unchecked.
file.attribute.readonly Optional String Displays attribute event for file or directory for which readonly attribute is checked or unchecked.

Authorization 

 Mandatory  String

Authorization token to authenticate to the Qualys Cloud Platform.

Prepend token with "Bearer" and one space. For example - Bearer authToken

Sample Sample 

API Request

curl -X POST 
<qualys_base_url>/fim/v2/events/ignore/count 
-H 'authorization: Bearer <token> ' 
-H 'content-type: application/json' 
-d @request.json

Contents of request.json

{
"filter":"dateTime:['2018-06-25T18:30:00.000Z'..'2019-06-20T18:29:59.999Z']"
}

Response

{
  "count": 234
}