로그 소스 알람

개요

관리하려면 다음 API 작업을 사용하세요 드롭오프 알람 Panther의 로그 소스에서. 이 엔드포인트는 Terraform 및 기타 인프라스트럭처-애즈-코드 워크플로용으로 설계되었습니다. 참조하세요 Terraform으로 로그 소스 알람 관리.

SCIM 쿼리에서는 SOURCE_NO_DATA 경보 유형은 사용자가 구성할 수 있으며 이 엔드포인트를 통해 노출됩니다. Panther 콘솔에 표시되는 다른 경보 유형(권한 확인, 분류 실패, 로그 처리 오류, 스캔 오류)은 시스템에서 관리됩니다.

필수 권한

• 자체 호스팅 GET 작업을 수행하려면, API 토큰에 다음이 있어야 합니다 로그 소스 보기 권한.

• 자체 호스팅 PUT 및 DELETE 작업을 수행하려면, API 토큰에 다음이 있어야 합니다 로그 소스 관리 권한.

작업

get log source alarm

get

Get a specific alarm for a log source

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

sourceIdstring · uuidRequired

The ID of the log source

typestring · enumRequired

The alarm type. Only SOURCE_NO_DATA is exposed.

Possible values:

Responses

200

OK response.

application/json

minutesThresholdinteger · int32Optional

The no-data evaluation period in minutes.

statestring · enumOptional

The current CloudWatch state of the alarm

Possible values:

typestring · enumRequired

The alarm type

Possible values:

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

504

timeout: Gateway Timeout response.

application/vnd.goa.error

get/log-source-alarms/{sourceId}/{type}

HTTPcURLJavaScriptPython

GET /log-source-alarms/{sourceId}/{type} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "minutesThreshold": 1,
  "state": "OK",
  "type": "SOURCE_NO_DATA"
}

put log source alarm

put

Create or update the drop-off threshold for a log source. Only the SOURCE_NO_DATA alarm type is user-configurable. Not supported for cloud-security sources (returns 400).

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

sourceIdstring · uuidRequired

The ID of the log source

typestring · enumRequired

The alarm type. Only SOURCE_NO_DATA is supported on PUT.

Possible values:

Body

application/json

minutesThresholdinteger · int32Required

The no-data evaluation period in minutes. Minimum 15, maximum 43200 (30 days).

Responses

200

OK response.

application/json

minutesThresholdinteger · int32Required

The configured no-data evaluation period in minutes

typestring · enumRequired

The alarm type

Possible values:

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

504

timeout: Gateway Timeout response.

application/vnd.goa.error

put/log-source-alarms/{sourceId}/{type}

HTTPcURLJavaScriptPython

PUT /log-source-alarms/{sourceId}/{type} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 22

{
  "minutesThreshold": 1
}

{
  "minutesThreshold": 1,
  "type": "SOURCE_NO_DATA"
}

delete log source alarm

delete

Delete the drop-off alarm for a log source. Idempotent: returns 204 even if no alarm exists.

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

sourceIdstring · uuidRequired

The ID of the log source

typestring · enumRequired

The alarm type. Only SOURCE_NO_DATA is supported on DELETE.

Possible values:

Responses

204

No Content response.

No content

400

bad_request: Bad Request response.

application/json

500

service: Internal Server Error response.

application/json

504

timeout: Gateway Timeout response.

application/vnd.goa.error

delete/log-source-alarms/{sourceId}/{type}

HTTPcURLJavaScriptPython

DELETE /log-source-alarms/{sourceId}/{type} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content