List SaaS API DLP Rule Events - Cloud Security API

{"type":"api","title":"List SaaS API DLP Rule Events","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/83e8a10367d157243cd1c3e478b807cb81262a3d/61bb1c24-108c-3cc9-bada-8c3e5985410b","info":{"title":"Cisco Secure Access Data Loss Prevention (DLP) Rule Events API","description":"Get the event data for the Secure Access Data Loss Prevention (DLP) rules: Real Time, SaaS API, and AI Guardrails DLP rules.","version":"1.0.0","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"DLP Rule Events","description":"Operations related to the DLP rule events."},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/reports/dlp-events-overview.md","uri":"secure-access-api-reference-dlp-events-overview"}},"openapi":"3.0.3","servers":[{"url":"https://api.sse.cisco.com/reports.{region}/v2","variables":{"region":{"default":"us","enum":["us","eu"],"description":"The region in the cloud where the system stores the DLP events."}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"The client credential flow.","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"reports.dlp:read":"Read dlp rule events"}}}}}},"spec":{"operationId":"getAllSaaSAPIEvents","summary":"List SaaS API DLP Rule Events","description":"List the DLP events triggered by the SaaS API DLP rules applied to the SaaS applications.\n","tags":["DLP Rule Events","Secure Access"],"security":[{"oauthFlow":["reports.dlp:read"]}],"parameters":[{"name":"action","in":"query","required":false,"description":"The action applied to the content. Supported values are: `blocked`, `deleted`, `monitored`, `quarantined`, `restored`, `revoked`.\n","schema":{"type":"string","enum":["blocked","deleted","monitored","quarantined","restored","revoked"]},"example":"monitored","$$ref":"#/components/parameters/action"},{"name":"severity","in":"query","required":false,"description":"The severity of the DLP rule that triggered the event.","schema":{"type":"string","enum":["INFO","WARNING","CRITICAL"]},"example":"WARNING","$$ref":"#/components/parameters/severity"},{"name":"identityType","in":"query","required":false,"description":"The type of the identity associated with the event, for example: `directory_user`, `directory_group`, or `network`.\n","schema":{"type":"string"},"example":"directory_user","$$ref":"#/components/parameters/identityType"},{"name":"applicationId","in":"query","required":false,"description":"The unique identifier of the application associated with the event.","schema":{"type":"integer"},"example":1234567,"$$ref":"#/components/parameters/applicationId"},{"name":"applicationCategoryId","in":"query","required":false,"description":"The unique identifier of the application category associated with the event.\n","schema":{"type":"integer"},"example":6789,"$$ref":"#/components/parameters/applicationCategoryId"},{"name":"from","in":"query","required":true,"description":"A timestamp or relative time string (for example: '-1days'). Filters for data that appears **after** this time.\n","schema":{"type":"string","example":"1639146300000"},"$$ref":"#/components/parameters/from"},{"name":"to","in":"query","required":true,"description":"A timestamp or relative time string (for example: 'now'). Filters for data that appears **before** this time.\n","schema":{"type":"string"},"example":"1640010300000","$$ref":"#/components/parameters/to"},{"name":"limit","in":"query","required":false,"description":"The maximum number of events to return on a page in the response.","schema":{"type":"integer","default":50},"example":25,"$$ref":"#/components/parameters/limit"},{"name":"offset","in":"query","required":false,"description":"A number that represents an index in the collection.","schema":{"type":"integer","default":0},"example":0,"$$ref":"#/components/parameters/offset"},{"name":"exposure","in":"query","required":false,"description":"The exposure level assigned to the scanned content.","schema":{"type":"string","enum":["PUBLIC","INTERNAL","EXTERNAL"]},"example":"INTERNAL","$$ref":"#/components/parameters/exposure"}],"responses":{"200":{"description":"OK","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The specific type of DLP rule events returned by the system in the response.","properties":{"events":{"type":"array","description":"The list of DLP rule events.","items":{"type":"object","description":"The properties of the SaaS API DLP rule event.","properties":{"eventId":{"type":"string","description":"A unique identifier for the DLP rule event.","example":"3cdaf59c-bb71-4923-8232-81927ab4284e"},"instanceName":{"type":"string","description":"The name of the authorized tenant for a SaaS API platform.","example":"office365_instance"},"detected":{"type":"string","format":"date-time","description":"The date and time when the system detected the content, formatted as an ISO 8601 timestamp.","example":"2024-01-01T12:34:56Z","$$ref":"#/components/schemas/detected"},"action":{"type":"string","description":"The action triggered by the DLP rule.","example":"MONITOR","$$ref":"#/components/schemas/action"},"fileName":{"type":"string","description":"The name of the file where the system identified a classification match. For messages or posts, the system returns `Content`.","example":"Content","$$ref":"#/components/schemas/fileName"},"destinationUrl":{"type":"string","description":"The URL where the end user uploadedor posted the file.","example":"https://us-east-1.console.aws.amazon.com/s3/object/s3-connector-demo-nov?prefix=S3%20Connector%20Demo%20Nov%20DLP.docx","$$ref":"#/components/schemas/destinationUrl"},"application":{"type":"object","description":"The properties of the application associated with the DLP rule event.","properties":{"id":{"type":"integer","description":"The unique identifier of the application.","example":46096,"$$ref":"#/components/schemas/idApplication"},"name":{"type":"string","description":"The name of the application.","example":"Gmail","$$ref":"#/components/schemas/nameApplication"}},"$$ref":"#/components/schemas/applicationSaasAPI"},"resourceId":{"type":"string","description":"The URL for the resource associated with the content that triggered the violation.","example":"arn:aws:s3:::s3-connector-demo-nov"},"resourceName":{"type":"string","description":"The name of the resource associated with the content that triggered the violation.","example":"s3-connector one"},"rule":{"type":"object","description":"The properties of the DLP rule that triggered the event.","properties":{"id":{"type":"string","description":"The unique identifier of the DLP rule.","example":"d29febed-52cc-4050-a950-ca23311a1a62","$$ref":"#/components/schemas/ruleId"},"name":{"type":"string","description":"The name of the DLP rule.","example":"rule name","$$ref":"#/components/schemas/ruleName"},"classifications":{"type":"array","description":"The list of the classifications associated with the rule.","items":{"type":"object","description":"The properties of the classifications.","properties":{"id":{"type":"string","description":"The unique identifier of the classification.","example":"978a8481-e6b3-4fa2-90c5-107707bce31d"},"name":{"type":"string","description":"The name of the classification.","example":"Built-in GDPR Classification"},"classifiers":{"type":"array","description":"The list of classifiers associated with the classification.","items":{"type":"object","description":"The properties of the classifier.","properties":{"id":{"type":"string","description":"The unique identifier of the classifier.","example":"1aa95033-9f63-47d0-ac26-f394c482878f"},"name":{"type":"string","description":"The name of the classifier.","example":"Credit Card Number – Strict"},"totalMatches":{"type":"integer","description":"The total number of matches found by the classifier.","example":16},"matches":{"type":"array","description":"The list of matches found by the classifier.","items":{"type":"object","description":"The properties of the match.","properties":{"text":{"type":"string","description":"The excerpt where the match was found.","example":"gdfis gisu ffiudsififuiusfiudsf iusdf iufd iudfs idsuf idsf y\n1. Credit Card Number ..."}}}}}}}}},"$$ref":"#/components/schemas/classifications"}},"$$ref":"#/components/schemas/rule"},"severity":{"type":"string","description":"The severity of the DLP rule.","example":"INFO","$$ref":"#/components/schemas/severity"},"exposure":{"type":"string","description":"An indication of who can see the file (internal or external users).","example":"INTERNAL"},"contentType":{"type":"string","description":"The type of data that triggered the DLP rule event.","example":"application/vnd.openxmlformats-officedocument.wordprocessingml.document","$$ref":"#/components/schemas/contentTypeSaasAPI"},"totalSizeInBytes":{"type":"integer","description":"The size of the file in bytes that triggered the DLP rule event.","example":253,"$$ref":"#/components/schemas/totalSizeInBytes"},"sha256Hash":{"type":"string","description":"The unique SHA256 hash of the file.","example":"0cf68d211b30ed28de43c637b55c096c09259b4b7b2cf1175dc5290093bdcaf0","$$ref":"#/components/schemas/sha256Hash"},"actor":{"type":"object","description":"The properties of the user details associated with a SaaS API DLP rule event.","properties":{"email":{"type":"string","description":"The email address of the SaaS API user.","example":"user_one@abc.onmicrosoft.com"},"uid":{"type":"string","description":"The unique identifier of the SaaS API user.","example":"3"},"displayName":{"type":"string","description":"The name of the SaaS API user used to show the user account in the system.","example":"name of user in the system"}},"$$ref":"#/components/schemas/SaasApiEventUser"},"owner":{"type":"object","description":"The properties of the user details associated with a SaaS API DLP rule event.","properties":{"email":{"type":"string","description":"The email address of the SaaS API user.","example":"user_one@abc.onmicrosoft.com"},"uid":{"type":"string","description":"The unique identifier of the SaaS API user.","example":"3"},"displayName":{"type":"string","description":"The name of the SaaS API user used to show the user account in the system.","example":"name of user in the system"}},"$$ref":"#/components/schemas/SaasApiEventUser"}},"$$ref":"#/components/schemas/SaasApiDlpRuleEvent"}}},"$$ref":"#/components/schemas/ListSaaSApiDlpRuleEvents"}}}},"400":{"description":"Bad Request","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/BadRequestError"},"401":{"description":"Unauthorized","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/UnauthorizedError"},"403":{"description":"Forbidden","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/ForbiddenError"},"404":{"description":"Not Found","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/NotFoundError"},"500":{"description":"Internal Server Error","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The timestamp of the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","description":"The standard error response format.","properties":{"error":{"type":"string","description":"Error description","example":"Something went wrong"},"statusCode":{"type":"integer","description":"HTTP status code","example":400},"txId":{"type":"string","description":"Unique transaction ID for tracing the request","example":"a82ddc7e-cd7e-4c2a-ab80-76577085fbc9"}},"$$ref":"#/components/schemas/ApiErrorResponse"}}},"$$ref":"#/components/responses/InternalServerError"}},"__originalOperationId":"getAllSaaSAPIEvents","method":"get","path":"/dlp/saasApi/events"}}