Get DLP Event Details - Cloud Security API

{"type":"api","title":"Get DLP Event Details","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/83e8a10367d157243cd1c3e478b807cb81262a3d/61bb1c24-108c-3cc9-bada-8c3e5985410b","info":{"title":"Cisco Secure Access Data Loss Prevention (DLP) Rule Events API","description":"Get the event data for the Secure Access Data Loss Prevention (DLP) rules: Real Time, SaaS API, and AI Guardrails DLP rules.","version":"1.0.0","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"DLP Rule Events","description":"Operations related to the DLP rule events."},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/reports/dlp-events-overview.md","uri":"secure-access-api-reference-dlp-events-overview"}},"openapi":"3.0.3","servers":[{"url":"https://api.sse.cisco.com/reports.{region}/v2","variables":{"region":{"default":"us","enum":["us","eu"],"description":"The region in the cloud where the system stores the DLP events."}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"The client credential flow.","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"reports.dlp:read":"Read dlp rule events"}}}}}},"spec":{"operationId":"getDlpEventDetailsById","summary":"Get DLP Event Details","tags":["DLP Rule Events","Secure Access"],"security":[{"oauthFlow":["reports.dlp:read"]}],"description":"Get the event details for a specific type of DLP rule using the event's unique ID.\nThe event type is either Real Time, SaaS API, or AI Guardrails DLP rules.\nThe response includes the event details, associated rule information, and classifications.","parameters":[{"name":"eventType","in":"path","required":true,"description":"The type of the event. Use one of the event types. * For Real-Time events, use `realTime`. * For SaaS API events, use `saasApi`. * For AI Guardrails events, use `aiGuardrails`.\n","schema":{"type":"string","enum":["realTime","saasApi","aiGuardrails"],"example":"realTime"},"$$ref":"#/components/parameters/eventType"},{"name":"id","in":"path","required":true,"description":"The unique identifier of the event.","schema":{"type":"string"},"example":"a1764e27-9e48-4dc4-8e93-e315472d42ed","$$ref":"#/components/parameters/id"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"description":"The specific type of DLP rule event returned by the system in the response.","oneOf":[{"type":"object","description":"The properties of the event including the associated DLP rule and classifications.","properties":{"detected":{"type":"string","format":"date-time","description":"The date and time when the system detected the content, formatted as an ISO 8601 timestamp.","example":"2024-01-01T12:34:56Z","$$ref":"#/components/schemas/detected"},"action":{"type":"string","description":"The action triggered by the DLP rule.","example":"MONITOR","$$ref":"#/components/schemas/action"},"fileName":{"type":"string","description":"The name of the file where the system identified a classification match. For messages or posts, the system returns `Content`.","example":"Content","$$ref":"#/components/schemas/fileName"},"identity":{"type":"object","description":"The properties of the identity or end user that requested the events.","properties":{"originId":{"type":"integer","description":"The unique identifier of the identity.","example":1339712162},"originTypeId":{"type":"integer","enum":[7],"description":"The numeric identifier of the identity for either `directory_user` or `directory_group`.","example":7}},"$$ref":"#/components/schemas/identity"},"privateResource":{"type":"object","description":"The private resource where the end user uploaded or posted the file.","properties":{"id":{"type":"string","description":"The unique identifier of the private resource.","example":"d29febed-52cc-4050-a950-ca23311a1a62"},"name":{"type":"string","description":"The name of the private resource.","example":"Resource-1"}},"$$ref":"#/components/schemas/privateResource"},"privateResourceGroup":{"type":"object","description":"The private resource group where the end user uploaded or posted the file.","properties":{"id":{"type":"string","description":"The unique identifier of the private resource group.","example":"d29febed-52cc-4050-a950-ca23311a1a62"},"name":{"type":"string","description":"The name of the private resource group.","example":"Resource-Group-1"}},"$$ref":"#/components/schemas/privateResourceGroup"},"destinationUrl":{"type":"string","description":"The URL where the end user uploadedor posted the file.","example":"https://us-east-1.console.aws.amazon.com/s3/object/s3-connector-demo-nov?prefix=S3%20Connector%20Demo%20Nov%20DLP.docx","$$ref":"#/components/schemas/destinationUrl"},"application":{"type":"object","description":"The properties of the application associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application.","example":46096,"$$ref":"#/components/schemas/idApplication"},"name":{"type":"string","description":"The name of the application.","example":"Gmail","$$ref":"#/components/schemas/nameApplication"}},"$$ref":"#/components/schemas/application"},"applicationCategory":{"type":"object","description":"The properties of the application category associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application category.","example":26},"name":{"type":"string","description":"The name of the application category.","example":"Office Productivity"}},"$$ref":"#/components/schemas/applicationCategory"},"rule":{"type":"object","description":"The properties of the DLP rule associated with the event.","properties":{"id":{"type":"string","description":"The unique identifier of the DLP rule.","example":"d29febed-52cc-4050-a950-ca23311a1a62","$$ref":"#/components/schemas/ruleId"},"name":{"type":"string","description":"The name of the DLP rule.","example":"rule name","$$ref":"#/components/schemas/ruleName"},"classifications":{"type":"array","description":"The list of the classifications associated with the rule.","items":{"type":"object","description":"The properties of the classifications.","properties":{"id":{"type":"string","description":"The unique identifier of the classification.","example":"978a8481-e6b3-4fa2-90c5-107707bce31d"},"name":{"type":"string","description":"The name of the classification.","example":"Built-in GDPR Classification"},"classifiers":{"type":"array","description":"The list of classifiers associated with the classification.","items":{"type":"object","description":"The properties of the classifier.","properties":{"id":{"type":"string","description":"The unique identifier of the classifier.","example":"1aa95033-9f63-47d0-ac26-f394c482878f"},"name":{"type":"string","description":"The name of the classifier.","example":"Credit Card Number – Strict"},"totalMatches":{"type":"integer","description":"The total number of matches found by the classifier.","example":16},"matches":{"type":"array","description":"The list of matches found by the classifier.","items":{"type":"object","description":"The properties of the match.","properties":{"text":{"type":"string","description":"The excerpt where the match was found.","example":"gdfis gisu ffiudsififuiusfiudsf iusdf iufd iudfs idsuf idsf y\n1. Credit Card Number ..."}}}}}}}}},"$$ref":"#/components/schemas/classifications"}}},"severity":{"type":"string","description":"The severity of the DLP rule.","example":"INFO","$$ref":"#/components/schemas/severity"},"fileLabels":{"type":"array","description":"The list of labels associated with the file.","items":{"type":"string","description":"The name of the label.","example":"Confidential"},"example":["Confidential"],"$$ref":"#/components/schemas/fileLabels"},"direction":{"type":"string","description":"The direction of the detected traffic.","example":"REQUEST","$$ref":"#/components/schemas/direction"},"contentType":{"type":"string","description":"The type of data that triggered the DLP rule event.","example":"application/json","$$ref":"#/components/schemas/contentType"},"totalSizeInBytes":{"type":"integer","description":"The size of the file in bytes that triggered the DLP rule event.","example":253,"$$ref":"#/components/schemas/totalSizeInBytes"},"sha256Hash":{"type":"string","description":"The unique SHA256 hash of the file.","example":"0cf68d211b30ed28de43c637b55c096c09259b4b7b2cf1175dc5290093bdcaf0","$$ref":"#/components/schemas/sha256Hash"}},"$$ref":"#/components/schemas/DLPRuleEventByType"},{"type":"object","description":"The properties of the SaaS API DLP rule event.","properties":{"eventId":{"type":"string","description":"A unique identifier for the DLP rule event.","example":"3cdaf59c-bb71-4923-8232-81927ab4284e"},"instanceName":{"type":"string","description":"The name of the authorized tenant for a SaaS API platform.","example":"office365_instance"},"detected":{"type":"string","format":"date-time","description":"The date and time when the system detected the content, formatted as an ISO 8601 timestamp.","example":"2024-01-01T12:34:56Z","$$ref":"#/components/schemas/detected"},"action":{"type":"string","description":"The action triggered by the DLP rule.","example":"MONITOR","$$ref":"#/components/schemas/action"},"fileName":{"type":"string","description":"The name of the file where the system identified a classification match. For messages or posts, the system returns `Content`.","example":"Content","$$ref":"#/components/schemas/fileName"},"destinationUrl":{"type":"string","description":"The URL where the end user uploadedor posted the file.","example":"https://us-east-1.console.aws.amazon.com/s3/object/s3-connector-demo-nov?prefix=S3%20Connector%20Demo%20Nov%20DLP.docx","$$ref":"#/components/schemas/destinationUrl"},"application":{"type":"object","description":"The properties of the application associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application.","example":46096,"$$ref":"#/components/schemas/idApplication"},"name":{"type":"string","description":"The name of the application.","example":"Gmail","$$ref":"#/components/schemas/nameApplication"}},"$$ref":"#/components/schemas/applicationSaasAPI"},"resourceId":{"type":"string","description":"The URL for the resource associated with the content that triggered the violation.","example":"arn:aws:s3:::s3-connector-demo-nov"},"resourceName":{"type":"string","description":"The name of the resource associated with the content that triggered the violation.","example":"s3-connector one"},"rule":{"type":"object","description":"The properties of the DLP rule that triggered the event.","properties":{"id":{"type":"string","description":"The unique identifier of the DLP rule.","example":"d29febed-52cc-4050-a950-ca23311a1a62","$$ref":"#/components/schemas/ruleId"},"name":{"type":"string","description":"The name of the DLP rule.","example":"rule name","$$ref":"#/components/schemas/ruleName"},"classifications":{"type":"array","description":"The list of the classifications associated with the rule.","items":{"type":"object","description":"The properties of the classifications.","properties":{"id":{"type":"string","description":"The unique identifier of the classification.","example":"978a8481-e6b3-4fa2-90c5-107707bce31d"},"name":{"type":"string","description":"The name of the classification.","example":"Built-in GDPR Classification"},"classifiers":{"type":"array","description":"The list of classifiers associated with the classification.","items":{"type":"object","description":"The properties of the classifier.","properties":{"id":{"type":"string","description":"The unique identifier of the classifier.","example":"1aa95033-9f63-47d0-ac26-f394c482878f"},"name":{"type":"string","description":"The name of the classifier.","example":"Credit Card Number – Strict"},"totalMatches":{"type":"integer","description":"The total number of matches found by the classifier.","example":16},"matches":{"type":"array","description":"The list of matches found by the classifier.","items":{"type":"object","description":"The properties of the match.","properties":{"text":{"type":"string","description":"The excerpt where the match was found.","example":"gdfis gisu ffiudsififuiusfiudsf iusdf iufd iudfs idsuf idsf y\n1. Credit Card Number ..."}}}}}}}}},"$$ref":"#/components/schemas/classifications"}},"$$ref":"#/components/schemas/rule"},"severity":{"type":"string","description":"The severity of the DLP rule.","example":"INFO","$$ref":"#/components/schemas/severity"},"exposure":{"type":"string","description":"An indication of who can see the file (internal or external users).","example":"INTERNAL"},"contentType":{"type":"string","description":"The type of data that triggered the DLP rule event.","example":"application/vnd.openxmlformats-officedocument.wordprocessingml.document","$$ref":"#/components/schemas/contentTypeSaasAPI"},"totalSizeInBytes":{"type":"integer","description":"The size of the file in bytes that triggered the DLP rule event.","example":253,"$$ref":"#/components/schemas/totalSizeInBytes"},"sha256Hash":{"type":"string","description":"The unique SHA256 hash of the file.","example":"0cf68d211b30ed28de43c637b55c096c09259b4b7b2cf1175dc5290093bdcaf0","$$ref":"#/components/schemas/sha256Hash"},"actor":{"type":"object","description":"The properties of the user details associated with a SaaS API DLP rule event.","properties":{"email":{"type":"string","description":"The email address of the SaaS API user.","example":"user_one@abc.onmicrosoft.com"},"uid":{"type":"string","description":"The unique identifier of the SaaS API user.","example":"3"},"displayName":{"type":"string","description":"The name of the SaaS API user used to show the user account in the system.","example":"name of user in the system"}},"$$ref":"#/components/schemas/SaasApiEventUser"},"owner":{"type":"object","description":"The properties of the user details associated with a SaaS API DLP rule event.","properties":{"email":{"type":"string","description":"The email address of the SaaS API user.","example":"user_one@abc.onmicrosoft.com"},"uid":{"type":"string","description":"The unique identifier of the SaaS API user.","example":"3"},"displayName":{"type":"string","description":"The name of the SaaS API user used to show the user account in the system.","example":"name of user in the system"}},"$$ref":"#/components/schemas/SaasApiEventUser"}},"$$ref":"#/components/schemas/SaasApiDlpRuleEvent"}],"$$ref":"#/components/schemas/DlpRuleEvent"}}}},"400":{"description":"Bad Request","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/BadRequestError"},"401":{"description":"Unauthorized","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/UnauthorizedError"},"403":{"description":"Forbidden","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/ForbiddenError"},"404":{"description":"Not Found","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/NotFoundError"},"500":{"description":"Internal Server Error","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/InternalServerError"}},"__originalOperationId":"getDlpEventDetailsById","method":"get","path":"/dlp/{eventType}/events/{id}"}}