DlpRuleEvent - Cloud Security API

{"type":"model","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/83e8a10367d157243cd1c3e478b807cb81262a3d/61bb1c24-108c-3cc9-bada-8c3e5985410b","info":{"title":"Cisco Secure Access Data Loss Prevention (DLP) Rule Events API","description":"Get the event data for the Secure Access Data Loss Prevention (DLP) rules: Real Time, SaaS API, and AI Guardrails DLP rules.","version":"1.0.0","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"DLP Rule Events","description":"Operations related to the DLP rule events."},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/reports/dlp-events-overview.md","uri":"secure-access-api-reference-dlp-events-overview"}},"openapi":"3.0.3","servers":[{"url":"https://api.sse.cisco.com/reports.{region}/v2","variables":{"region":{"default":"us","enum":["us","eu"],"description":"The region in the cloud where the system stores the DLP events."}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"The client credential flow.","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"reports.dlp:read":"Read dlp rule events"}}}}}},"spec":{"description":"The specific type of DLP rule event returned by the system in the response.","oneOf":[{"type":"object","description":"The properties of the event including the associated DLP rule and classifications.","properties":{"detected":{"type":"string","format":"date-time","description":"The date and time when the system detected the content, formatted as an ISO 8601 timestamp.","example":"2024-01-01T12:34:56Z","$$ref":"#/components/schemas/detected"},"action":{"type":"string","description":"The action triggered by the DLP rule.","example":"MONITOR","$$ref":"#/components/schemas/action"},"fileName":{"type":"string","description":"The name of the file where the system identified a classification match. For messages or posts, the system returns `Content`.","example":"Content","$$ref":"#/components/schemas/fileName"},"identity":{"type":"object","description":"The properties of the identity or end user that requested the events.","properties":{"originId":{"type":"integer","description":"The unique identifier of the identity.","example":1339712162},"originTypeId":{"type":"integer","enum":[7],"description":"The numeric identifier of the identity for either `directory_user` or `directory_group`.","example":7}},"$$ref":"#/components/schemas/identity"},"privateResource":{"type":"object","description":"The private resource where the end user uploaded or posted the file.","properties":{"id":{"type":"string","description":"The unique identifier of the private resource.","example":"d29febed-52cc-4050-a950-ca23311a1a62"},"name":{"type":"string","description":"The name of the private resource.","example":"Resource-1"}},"$$ref":"#/components/schemas/privateResource"},"privateResourceGroup":{"type":"object","description":"The private resource group where the end user uploaded or posted the file.","properties":{"id":{"type":"string","description":"The unique identifier of the private resource group.","example":"d29febed-52cc-4050-a950-ca23311a1a62"},"name":{"type":"string","description":"The name of the private resource group.","example":"Resource-Group-1"}},"$$ref":"#/components/schemas/privateResourceGroup"},"destinationUrl":{"type":"string","description":"The URL where the end user uploadedor posted the file.","example":"https://us-east-1.console.aws.amazon.com/s3/object/s3-connector-demo-nov?prefix=S3%20Connector%20Demo%20Nov%20DLP.docx","$$ref":"#/components/schemas/destinationUrl"},"application":{"type":"object","description":"The properties of the application associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application.","example":46096,"$$ref":"#/components/schemas/idApplication"},"name":{"type":"string","description":"The name of the application.","example":"Gmail","$$ref":"#/components/schemas/nameApplication"}},"$$ref":"#/components/schemas/application"},"applicationCategory":{"type":"object","description":"The properties of the application category associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application category.","example":26},"name":{"type":"string","description":"The name of the application category.","example":"Office Productivity"}},"$$ref":"#/components/schemas/applicationCategory"},"rule":{"type":"object","description":"The properties of the DLP rule associated with the event.","properties":{"id":{"type":"string","description":"The unique identifier of the DLP rule.","example":"d29febed-52cc-4050-a950-ca23311a1a62","$$ref":"#/components/schemas/ruleId"},"name":{"type":"string","description":"The name of the DLP rule.","example":"rule name","$$ref":"#/components/schemas/ruleName"},"classifications":{"type":"array","description":"The list of the classifications associated with the rule.","items":{"type":"object","description":"The properties of the classifications.","properties":{"id":{"type":"string","description":"The unique identifier of the classification.","example":"978a8481-e6b3-4fa2-90c5-107707bce31d"},"name":{"type":"string","description":"The name of the classification.","example":"Built-in GDPR Classification"},"classifiers":{"type":"array","description":"The list of classifiers associated with the classification.","items":{"type":"object","description":"The properties of the classifier.","properties":{"id":{"type":"string","description":"The unique identifier of the classifier.","example":"1aa95033-9f63-47d0-ac26-f394c482878f"},"name":{"type":"string","description":"The name of the classifier.","example":"Credit Card Number – Strict"},"totalMatches":{"type":"integer","description":"The total number of matches found by the classifier.","example":16},"matches":{"type":"array","description":"The list of matches found by the classifier.","items":{"type":"object","description":"The properties of the match.","properties":{"text":{"type":"string","description":"The excerpt where the match was found.","example":"gdfis gisu ffiudsififuiusfiudsf iusdf iufd iudfs idsuf idsf y\n1. Credit Card Number ..."}}}}}}}}},"$$ref":"#/components/schemas/classifications"}}},"severity":{"type":"string","description":"The severity of the DLP rule.","example":"INFO","$$ref":"#/components/schemas/severity"},"fileLabels":{"type":"array","description":"The list of labels associated with the file.","items":{"type":"string","description":"The name of the label.","example":"Confidential"},"example":["Confidential"],"$$ref":"#/components/schemas/fileLabels"},"direction":{"type":"string","description":"The direction of the detected traffic.","example":"REQUEST","$$ref":"#/components/schemas/direction"},"contentType":{"type":"string","description":"The type of data that triggered the DLP rule event.","example":"application/json","$$ref":"#/components/schemas/contentType"},"totalSizeInBytes":{"type":"integer","description":"The size of the file in bytes that triggered the DLP rule event.","example":253,"$$ref":"#/components/schemas/totalSizeInBytes"},"sha256Hash":{"type":"string","description":"The unique SHA256 hash of the file.","example":"0cf68d211b30ed28de43c637b55c096c09259b4b7b2cf1175dc5290093bdcaf0","$$ref":"#/components/schemas/sha256Hash"}},"$$ref":"#/components/schemas/DLPRuleEventByType"},{"type":"object","description":"The properties of the SaaS API DLP rule event.","properties":{"eventId":{"type":"string","description":"A unique identifier for the DLP rule event.","example":"3cdaf59c-bb71-4923-8232-81927ab4284e"},"instanceName":{"type":"string","description":"The name of the authorized tenant for a SaaS API platform.","example":"office365_instance"},"detected":{"type":"string","format":"date-time","description":"The date and time when the system detected the content, formatted as an ISO 8601 timestamp.","example":"2024-01-01T12:34:56Z","$$ref":"#/components/schemas/detected"},"action":{"type":"string","description":"The action triggered by the DLP rule.","example":"MONITOR","$$ref":"#/components/schemas/action"},"fileName":{"type":"string","description":"The name of the file where the system identified a classification match. For messages or posts, the system returns `Content`.","example":"Content","$$ref":"#/components/schemas/fileName"},"destinationUrl":{"type":"string","description":"The URL where the end user uploadedor posted the file.","example":"https://us-east-1.console.aws.amazon.com/s3/object/s3-connector-demo-nov?prefix=S3%20Connector%20Demo%20Nov%20DLP.docx","$$ref":"#/components/schemas/destinationUrl"},"application":{"type":"object","description":"The properties of the application associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application.","example":46096,"$$ref":"#/components/schemas/idApplication"},"name":{"type":"string","description":"The name of the application.","example":"Gmail","$$ref":"#/components/schemas/nameApplication"}},"$$ref":"#/components/schemas/applicationSaasAPI"},"resourceId":{"type":"string","description":"The URL for the resource associated with the content that triggered the violation.","example":"arn:aws:s3:::s3-connector-demo-nov"},"resourceName":{"type":"string","description":"The name of the resource associated with the content that triggered the violation.","example":"s3-connector one"},"rule":{"type":"object","description":"The properties of the DLP rule that triggered the event.","properties":{"id":{"type":"string","description":"The unique identifier of the DLP rule.","example":"d29febed-52cc-4050-a950-ca23311a1a62","$$ref":"#/components/schemas/ruleId"},"name":{"type":"string","description":"The name of the DLP rule.","example":"rule name","$$ref":"#/components/schemas/ruleName"},"classifications":{"type":"array","description":"The list of the classifications associated with the rule.","items":{"type":"object","description":"The properties of the classifications.","properties":{"id":{"type":"string","description":"The unique identifier of the classification.","example":"978a8481-e6b3-4fa2-90c5-107707bce31d"},"name":{"type":"string","description":"The name of the classification.","example":"Built-in GDPR Classification"},"classifiers":{"type":"array","description":"The list of classifiers associated with the classification.","items":{"type":"object","description":"The properties of the classifier.","properties":{"id":{"type":"string","description":"The unique identifier of the classifier.","example":"1aa95033-9f63-47d0-ac26-f394c482878f"},"name":{"type":"string","description":"The name of the classifier.","example":"Credit Card Number – Strict"},"totalMatches":{"type":"integer","description":"The total number of matches found by the classifier.","example":16},"matches":{"type":"array","description":"The list of matches found by the classifier.","items":{"type":"object","description":"The properties of the match.","properties":{"text":{"type":"string","description":"The excerpt where the match was found.","example":"gdfis gisu ffiudsififuiusfiudsf iusdf iufd iudfs idsuf idsf y\n1. Credit Card Number ..."}}}}}}}}},"$$ref":"#/components/schemas/classifications"}},"$$ref":"#/components/schemas/rule"},"severity":{"type":"string","description":"The severity of the DLP rule.","example":"INFO","$$ref":"#/components/schemas/severity"},"exposure":{"type":"string","description":"An indication of who can see the file (internal or external users).","example":"INTERNAL"},"contentType":{"type":"string","description":"The type of data that triggered the DLP rule event.","example":"application/vnd.openxmlformats-officedocument.wordprocessingml.document","$$ref":"#/components/schemas/contentTypeSaasAPI"},"totalSizeInBytes":{"type":"integer","description":"The size of the file in bytes that triggered the DLP rule event.","example":253,"$$ref":"#/components/schemas/totalSizeInBytes"},"sha256Hash":{"type":"string","description":"The unique SHA256 hash of the file.","example":"0cf68d211b30ed28de43c637b55c096c09259b4b7b2cf1175dc5290093bdcaf0","$$ref":"#/components/schemas/sha256Hash"},"actor":{"type":"object","description":"The properties of the user details associated with a SaaS API DLP rule event.","properties":{"email":{"type":"string","description":"The email address of the SaaS API user.","example":"user_one@abc.onmicrosoft.com"},"uid":{"type":"string","description":"The unique identifier of the SaaS API user.","example":"3"},"displayName":{"type":"string","description":"The name of the SaaS API user used to show the user account in the system.","example":"name of user in the system"}},"$$ref":"#/components/schemas/SaasApiEventUser"},"owner":{"type":"object","description":"The properties of the user details associated with a SaaS API DLP rule event.","properties":{"email":{"type":"string","description":"The email address of the SaaS API user.","example":"user_one@abc.onmicrosoft.com"},"uid":{"type":"string","description":"The unique identifier of the SaaS API user.","example":"3"},"displayName":{"type":"string","description":"The name of the SaaS API user used to show the user account in the system.","example":"name of user in the system"}},"$$ref":"#/components/schemas/SaasApiEventUser"}},"$$ref":"#/components/schemas/SaasApiDlpRuleEvent"}],"$$ref":"#/components/schemas/DlpRuleEvent","title":"DlpRuleEvent"}}