Collect Events

The following attributes can be modified and are supplied as JSON object in the body:

Preliminary actions

Query Parameters:	No parameters
JSON body:	token (string) (Required) – Client access key. The key can be found in Client portal -> Account Settings -> System https://<clientaccount>.dhound.io/settings/system hd (string) (Required) – unique asset key. The key can be found in Client Portal -> Asset Management -> Asset ult (ulong) (Optional) - asset UTC local time in Unix format (seconds since Jan 01 1970) ulto (ulong) (Optional) – asset time zone offset in seconds er (string) (Optional) – error that could happened during parsing events events (array) (Required) – array of security events. Below are fields of each security event: sid (uint) (Required) – security event identifier. Sids of predefined events can be found here, sids of custom events - https://knowledge.dhound.io/how-to-use-dhound/custom-security-events gid (uint) (Optional) – security group id, description - https://knowledge.dhound.io/how-to-use-dhound/security-events/security-groups-and-events t (ulong) (Required) – security event time in unix format (seconds since Jan 01 1970) ip (string) (Optional) – remote ip address that connected with security event m (string) (Optional) – security event message, if not defined, server default message will be taken by sid src (string) (Optional) – source where event is found a (dictionary<string, string>) (Optional) – additional fields associated with events (for example, port number, user)
Method:	POST
Url:	https://gate.dhound.io/collect

Example

POST https://gate.dhound.io/collect


{
	"token": "5SX7W_TBD",
	"hd": "DU1Y_TBD",
	"ult": 1542471619,
	"ulto": 10800,
	"events": [
		{
			"sid": 20510,
			"t": 1542462948,
			"m": "new software \u003cUpdate for Windows 10 for x64-based Systems (KB4023057)\u003e installed on the server",
			"ip": "LOCAL",
			"a": {
				"eventid": "1033",
				"recordid": "38976",
				"soft": "Update for Windows 10 for x64-based Systems (KB4023057)"
			},
			"src": "EventLogs\Application"
		}
	]
}

On This Page

Collect Events

Preliminary actions

Example

See Also