{ "info": { "_postman_id": "32fbbc2e-adcb-44e4-8144-5d36d7080265", "name": "Tanium Threat Response API", "description": "The Tanium Threat Response REST API enables starting investigations, viewing Recorder events, gathering evidence, and performing file and directory operations on endpoints for threat detection and incident response. All endpoints are under the /plugin/products/threat-response/api/v1/ base path.\n\nContact Support:\n Name: Tanium Support", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-06-05T15:19:00.000Z", "updatedAt": "2026-06-05T15:19:02.000Z", "lastUpdatedBy": "35240", "uid": "35240-32fbbc2e-adcb-44e4-8144-5d36d7080265" }, "item": [ { "name": "plugin", "item": [ { "name": "products", "item": [ { "name": "threat-response", "item": [ { "name": "api", "item": [ { "name": "v1", "item": [ { "name": "status", "item": [ { "name": "Get Threat Response Service Status", "id": "15e310ee-379c-4805-afbf-7132deeee20b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "status" ] }, "description": "Returns the current status of the Tanium Threat Response service including version information and operational state." }, "response": [ { "id": "80a0eb15-df87-4a5b-8243-392125372f0f", "name": "Status retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "status" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"version\": \"\",\n \"status\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-80a0eb15-df87-4a5b-8243-392125372f0f" }, { "id": "da9c90f6-f1f8-4c9c-8e18-06c7a16633bc", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/status", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "status" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-da9c90f6-f1f8-4c9c-8e18-06c7a16633bc" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-15e310ee-379c-4805-afbf-7132deeee20b" } ], "id": "6a07ec25-46b9-4b29-8d00-f868a6323087", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6a07ec25-46b9-4b29-8d00-f868a6323087" }, { "name": "alerts", "item": [ { "name": "{alertId}", "item": [ { "name": "Get An Alert By ID", "id": "5a46442c-c71f-4a7c-9004-7b3077db44ec", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "id": "5a436bb6-4a47-45ac-aaca-e043978eadef", "key": "alertId", "value": "", "description": "(Required) Unique identifier of the alert" } ] }, "description": "Retrieves the full details of a specific alert including associated computer information, intel document references, and current state." }, "response": [ { "id": "53867d30-b7ad-4d96-b46c-4642e5e62ce4", "name": "Alert retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "key": "alertId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"priority\": \"\",\n \"severity\": \"\",\n \"type\": \"\",\n \"state\": \"ignored\",\n \"computerName\": \"\",\n \"computerIpAddress\": \"\",\n \"guid\": \"\",\n \"intelDocId\": \"\",\n \"alertedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-53867d30-b7ad-4d96-b46c-4642e5e62ce4" }, { "id": "494b4f0e-3da0-4da8-879b-325b11ca5c62", "name": "Alert not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "key": "alertId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-494b4f0e-3da0-4da8-879b-325b11ca5c62" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-5a46442c-c71f-4a7c-9004-7b3077db44ec" }, { "name": "Update Alert State", "id": "7962bafc-efe0-4a96-8edf-70efa7e1ff40", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"state\": \"ignored\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "id": "bdb5a17d-48e0-416c-aced-6b599f43eef7", "key": "alertId", "value": "", "description": "(Required) Alert ID or comma-separated list of alert IDs" } ] }, "description": "Updates the state of one or more alerts. Multiple alert IDs can be provided as a comma-separated list in the path. Valid states are unresolved, inprogress, resolved, dismissed, and ignored." }, "response": [ { "id": "ef0a1515-6cbd-41f3-9836-c3366057716a", "name": "Alert state updated successfully", "originalRequest": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"state\": \"ignored\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "key": "alertId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ef0a1515-6cbd-41f3-9836-c3366057716a" }, { "id": "7417c442-8740-427b-be42-704b7cd413ec", "name": "Invalid state value", "originalRequest": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"state\": \"ignored\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "key": "alertId" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7417c442-8740-427b-be42-704b7cd413ec" }, { "id": "5580e965-4d98-4343-be7c-20bd8df3e62f", "name": "Alert not found", "originalRequest": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"state\": \"ignored\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts/:alertId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts", ":alertId" ], "variable": [ { "key": "alertId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-5580e965-4d98-4343-be7c-20bd8df3e62f" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7962bafc-efe0-4a96-8edf-70efa7e1ff40" } ], "id": "bcbb8553-15df-4489-83f8-d38433631477", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-bcbb8553-15df-4489-83f8-d38433631477" }, { "name": "List Threat Alerts", "id": "b1624a25-1a8c-4bcb-9797-c0c9370cd87d", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts?limit=&offset=&computer_ip_address=&computer_name=&scan_config_id=&intel_doc_id=&severity=&priority=&type=&state=unresolved", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts" ], "query": [ { "description": "Maximum number of alerts to return", "key": "limit", "value": "" }, { "description": "Number of alerts to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by computer IP address", "key": "computer_ip_address", "value": "" }, { "description": "Filter by computer hostname", "key": "computer_name", "value": "" }, { "description": "Filter by scan configuration identifier", "key": "scan_config_id", "value": "" }, { "description": "Filter by intel document identifier", "key": "intel_doc_id", "value": "" }, { "description": "Filter by alert severity", "key": "severity", "value": "" }, { "description": "Filter by alert priority", "key": "priority", "value": "" }, { "description": "Filter by alert type", "key": "type", "value": "" }, { "description": "Filter by alert state", "key": "state", "value": "unresolved" } ] }, "description": "Retrieves a paginated list of threat alerts. Alerts can be filtered by computer name, IP address, severity, priority, type, state, and associated intel document or scan configuration." }, "response": [ { "id": "97bc5800-9252-4c1c-a0aa-886f97efb48d", "name": "Alerts retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts?limit=&offset=&computer_ip_address=&computer_name=&scan_config_id=&intel_doc_id=&severity=&priority=&type=&state=unresolved", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts" ], "query": [ { "description": "Maximum number of alerts to return", "key": "limit", "value": "" }, { "description": "Number of alerts to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by computer IP address", "key": "computer_ip_address", "value": "" }, { "description": "Filter by computer hostname", "key": "computer_name", "value": "" }, { "description": "Filter by scan configuration identifier", "key": "scan_config_id", "value": "" }, { "description": "Filter by intel document identifier", "key": "intel_doc_id", "value": "" }, { "description": "Filter by alert severity", "key": "severity", "value": "" }, { "description": "Filter by alert priority", "key": "priority", "value": "" }, { "description": "Filter by alert type", "key": "type", "value": "" }, { "description": "Filter by alert state", "key": "state", "value": "unresolved" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"priority\": \"\",\n \"severity\": \"\",\n \"type\": \"\",\n \"state\": \"dismissed\",\n \"computerName\": \"\",\n \"computerIpAddress\": \"\",\n \"guid\": \"\",\n \"intelDocId\": \"\",\n \"alertedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"priority\": \"\",\n \"severity\": \"\",\n \"type\": \"\",\n \"state\": \"unresolved\",\n \"computerName\": \"\",\n \"computerIpAddress\": \"\",\n \"guid\": \"\",\n \"intelDocId\": \"\",\n \"alertedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-97bc5800-9252-4c1c-a0aa-886f97efb48d" }, { "id": "42dc0a34-3c74-4051-9dc6-d675ee31bb03", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/alerts?limit=&offset=&computer_ip_address=&computer_name=&scan_config_id=&intel_doc_id=&severity=&priority=&type=&state=unresolved", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "alerts" ], "query": [ { "description": "Maximum number of alerts to return", "key": "limit", "value": "" }, { "description": "Number of alerts to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by computer IP address", "key": "computer_ip_address", "value": "" }, { "description": "Filter by computer hostname", "key": "computer_name", "value": "" }, { "description": "Filter by scan configuration identifier", "key": "scan_config_id", "value": "" }, { "description": "Filter by intel document identifier", "key": "intel_doc_id", "value": "" }, { "description": "Filter by alert severity", "key": "severity", "value": "" }, { "description": "Filter by alert priority", "key": "priority", "value": "" }, { "description": "Filter by alert type", "key": "type", "value": "" }, { "description": "Filter by alert state", "key": "state", "value": "unresolved" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-42dc0a34-3c74-4051-9dc6-d675ee31bb03" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-b1624a25-1a8c-4bcb-9797-c0c9370cd87d" } ], "id": "2075e144-361d-413b-ae1f-889572f8236d", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-2075e144-361d-413b-ae1f-889572f8236d" }, { "name": "conns", "item": [ { "name": "connect", "item": [ { "name": "Create A Live Connection To An Endpoint", "id": "6e1f2a81-1d36-4ecb-af5d-563d3a07ff1a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"client_id\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"hostname\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/connect", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "connect" ] }, "description": "Initiates a live connection to a specified endpoint for investigation purposes. Requires the client ID, IP, platform, and hostname of the target endpoint." }, "response": [ { "id": "4e3da560-1cf4-48f8-85ee-b3760181d59d", "name": "Connection initiated successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"client_id\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"hostname\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/connect", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "connect" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"hostname\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"status\": \"\",\n \"initiatedAt\": \"\",\n \"connectedAt\": \"\",\n \"message\": \"\",\n \"clientId\": \"\",\n \"userId\": \"\",\n \"eid\": \"\",\n \"personaId\": \"\",\n \"hasTools\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-4e3da560-1cf4-48f8-85ee-b3760181d59d" }, { "id": "1dd803ef-7875-43fb-a12e-c4792cde73e5", "name": "Invalid connection parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"client_id\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"hostname\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/connect", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "connect" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-1dd803ef-7875-43fb-a12e-c4792cde73e5" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6e1f2a81-1d36-4ecb-af5d-563d3a07ff1a" } ], "id": "3e951eaf-f6b1-432b-a752-7874426e405d", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3e951eaf-f6b1-432b-a752-7874426e405d" }, { "name": "{connectionId}", "item": [ { "name": "snapshot", "item": [ { "name": "Create An Endpoint Snapshot", "id": "37b6a375-6d2d-42a6-936d-632cd0f23614", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/snapshot", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "snapshot" ], "variable": [ { "id": "60f3cadf-4d1f-4ef7-9a68-58d5258c5258", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" } ] }, "description": "Initiates a snapshot capture from a connected endpoint. The snapshot captures a point-in-time image of endpoint Recorder data for offline analysis." }, "response": [ { "id": "a4fda46d-023d-4999-89fd-83d1318726c6", "name": "Snapshot creation initiated", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/snapshot", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "snapshot" ], "variable": [ { "key": "connectionId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"taskId\": \"\",\n \"status\": \"\",\n \"startTime\": \"\",\n \"connection\": {\n \"id\": \"\"\n }\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-a4fda46d-023d-4999-89fd-83d1318726c6" }, { "id": "251e4165-064a-425a-bb82-370e86d915dc", "name": "Connection not found", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/snapshot", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "snapshot" ], "variable": [ { "key": "connectionId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-251e4165-064a-425a-bb82-370e86d915dc" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-37b6a375-6d2d-42a6-936d-632cd0f23614" } ], "id": "a3ab2b29-5a28-4d34-b3d5-eb598ebc041e", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-a3ab2b29-5a28-4d34-b3d5-eb598ebc041e" }, { "name": "views", "item": [ { "name": "{eventType}", "item": [ { "name": "events", "item": [ { "name": "List Events By Type", "id": "3eef98d7-3c4c-4a84-b22b-f53e51bca16e", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/views/:eventType/events?limit=&offset=&filter=&match=&sort=&fields=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "views", ":eventType", "events" ], "query": [ { "description": "Maximum number of events to return", "key": "limit", "value": "" }, { "description": "Number of events to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter expression for events", "key": "filter", "value": "" }, { "description": "Match mode for filter expression", "key": "match", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Comma-separated list of fields to include", "key": "fields", "value": "" } ], "variable": [ { "id": "30b3ec1d-ee22-41a1-b183-d88fb8584c6b", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" }, { "id": "2d6948af-c75f-47cb-a401-19b86432b298", "key": "eventType", "value": "DNS", "description": "(Required) Type of events to retrieve" } ] }, "description": "Retrieves Recorder events from a connected endpoint filtered by event type. Supported event types include File, Network, Registry, Process, Driver, Combined, DNS, and Image." }, "response": [ { "id": "cd4de59b-f1cc-4cc2-9b25-ebfada2a2f29", "name": "Events retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/views/:eventType/events?limit=&offset=&filter=&match=&sort=&fields=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "views", ":eventType", "events" ], "query": [ { "description": "Maximum number of events to return", "key": "limit", "value": "" }, { "description": "Number of events to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter expression for events", "key": "filter", "value": "" }, { "description": "Match mode for filter expression", "key": "match", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Comma-separated list of fields to include", "key": "fields", "value": "" } ], "variable": [ { "key": "connectionId" }, { "key": "eventType" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"timestamp\": \"\",\n \"operation\": \"\",\n \"processId\": \"\",\n \"pid\": \"\",\n \"processPath\": \"\",\n \"processTableId\": \"\",\n \"processCommandLine\": \"\",\n \"parentCommandLine\": \"\",\n \"processHash\": \"\",\n \"userName\": \"\",\n \"groupName\": \"\",\n \"file\": \"\",\n \"remoteAddress\": \"\",\n \"remoteAddressPort\": \"\",\n \"localAddress\": \"\",\n \"localAddressPort\": \"\",\n \"keyPath\": \"\",\n \"valueName\": \"\",\n \"exitCode\": \"\",\n \"imageLoaded\": \"\",\n \"signature\": \"\",\n \"signed\": \"\"\n },\n {\n \"id\": \"\",\n \"timestamp\": \"\",\n \"operation\": \"\",\n \"processId\": \"\",\n \"pid\": \"\",\n \"processPath\": \"\",\n \"processTableId\": \"\",\n \"processCommandLine\": \"\",\n \"parentCommandLine\": \"\",\n \"processHash\": \"\",\n \"userName\": \"\",\n \"groupName\": \"\",\n \"file\": \"\",\n \"remoteAddress\": \"\",\n \"remoteAddressPort\": \"\",\n \"localAddress\": \"\",\n \"localAddressPort\": \"\",\n \"keyPath\": \"\",\n \"valueName\": \"\",\n \"exitCode\": \"\",\n \"imageLoaded\": \"\",\n \"signature\": \"\",\n \"signed\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-cd4de59b-f1cc-4cc2-9b25-ebfada2a2f29" }, { "id": "8c3b61af-1986-420d-8e24-6da333cbd13e", "name": "Connection not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/views/:eventType/events?limit=&offset=&filter=&match=&sort=&fields=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "views", ":eventType", "events" ], "query": [ { "description": "Maximum number of events to return", "key": "limit", "value": "" }, { "description": "Number of events to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter expression for events", "key": "filter", "value": "" }, { "description": "Match mode for filter expression", "key": "match", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Comma-separated list of fields to include", "key": "fields", "value": "" } ], "variable": [ { "key": "connectionId" }, { "key": "eventType" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-8c3b61af-1986-420d-8e24-6da333cbd13e" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3eef98d7-3c4c-4a84-b22b-f53e51bca16e" } ], "id": "9876ee8a-c196-4e8d-9390-91eae83f3370", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-9876ee8a-c196-4e8d-9390-91eae83f3370" }, { "name": "eventsCount", "item": [ { "name": "Get Events Count Summary", "id": "e986fd1b-cb54-4441-ace6-be748f0fa7cd", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/views/:eventType/eventsCount", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "views", ":eventType", "eventsCount" ], "variable": [ { "id": "ae137659-bb5b-4a18-953b-42375f40c667", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" }, { "id": "582e4f9c-c16c-41a1-8ab7-31acb85f8b78", "key": "eventType", "value": "DNS", "description": "(Required) Type of events to count" } ] }, "description": "Returns a summary count of Recorder events by type for a specific connection, useful for understanding the volume of activity on an endpoint." }, "response": [ { "id": "3c6c1bf9-8c91-47ad-89a3-2082360fac17", "name": "Event count retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/views/:eventType/eventsCount", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "views", ":eventType", "eventsCount" ], "variable": [ { "key": "connectionId" }, { "key": "eventType" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"count\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3c6c1bf9-8c91-47ad-89a3-2082360fac17" }, { "id": "f7884b29-7342-43b2-ab2d-3c599ec880fb", "name": "Connection not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/views/:eventType/eventsCount", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "views", ":eventType", "eventsCount" ], "variable": [ { "key": "connectionId" }, { "key": "eventType" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f7884b29-7342-43b2-ab2d-3c599ec880fb" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e986fd1b-cb54-4441-ace6-be748f0fa7cd" } ], "id": "c0f95190-96f3-4964-8cce-ebf365c42756", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-c0f95190-96f3-4964-8cce-ebf365c42756" } ], "id": "d74d51ba-0edf-45b0-ad8b-c8e1cf32c13d", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-d74d51ba-0edf-45b0-ad8b-c8e1cf32c13d" } ], "id": "8dff180b-8713-4eb5-bcc3-1aa8a83314c9", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-8dff180b-8713-4eb5-bcc3-1aa8a83314c9" }, { "name": "processevents", "item": [ { "name": "{processTableId}", "item": [ { "name": "{eventType}", "item": [ { "name": "Get Events For A Specific Process", "id": "b55c8f33-4c39-4d7b-a00b-c7c3a75059b8", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/processevents/:processTableId/:eventType?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "processevents", ":processTableId", ":eventType" ], "query": [ { "description": "Maximum number of events to return", "key": "limit", "value": "" }, { "description": "Number of events to skip for pagination", "key": "offset", "value": "" } ], "variable": [ { "id": "3cc568fa-1430-486a-ba84-b20fdc6384aa", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" }, { "id": "9213ee6d-53b8-4a7b-b59c-fbed3a3d5563", "key": "processTableId", "value": "", "description": "(Required) Process table identifier" }, { "id": "be48ca3d-3eb3-406d-a7ca-e8b00db9c25f", "key": "eventType", "value": "Registry", "description": "(Required) Type of events to retrieve for the process" } ] }, "description": "Retrieves events associated with a specific process on a connected endpoint, identified by its process table ID and event type." }, "response": [ { "id": "6c3e0add-8b74-4925-bdeb-b1a9e7b8d405", "name": "Process events retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/processevents/:processTableId/:eventType?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "processevents", ":processTableId", ":eventType" ], "query": [ { "description": "Maximum number of events to return", "key": "limit", "value": "" }, { "description": "Number of events to skip for pagination", "key": "offset", "value": "" } ], "variable": [ { "key": "connectionId" }, { "key": "processTableId" }, { "key": "eventType" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"type\": \"\",\n \"operation\": \"\",\n \"detail\": \"\",\n \"timestamp\": \"\"\n },\n {\n \"id\": \"\",\n \"type\": \"\",\n \"operation\": \"\",\n \"detail\": \"\",\n \"timestamp\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6c3e0add-8b74-4925-bdeb-b1a9e7b8d405" }, { "id": "fd7ec3d9-8cb4-46b8-82f7-2bd3307bfaef", "name": "Connection or process not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/processevents/:processTableId/:eventType?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "processevents", ":processTableId", ":eventType" ], "query": [ { "description": "Maximum number of events to return", "key": "limit", "value": "" }, { "description": "Number of events to skip for pagination", "key": "offset", "value": "" } ], "variable": [ { "key": "connectionId" }, { "key": "processTableId" }, { "key": "eventType" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-fd7ec3d9-8cb4-46b8-82f7-2bd3307bfaef" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-b55c8f33-4c39-4d7b-a00b-c7c3a75059b8" } ], "id": "bcf308c2-f8f0-43c5-9622-86970916ea3d", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-bcf308c2-f8f0-43c5-9622-86970916ea3d" } ], "id": "8eb84f29-f39e-48cf-8cc5-86b834afe05b", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-8eb84f29-f39e-48cf-8cc5-86b834afe05b" } ], "id": "6cca4478-95cc-466f-a9bd-7576a8385ae0", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6cca4478-95cc-466f-a9bd-7576a8385ae0" }, { "name": "processtrees", "item": [ { "name": "{processTableId}", "item": [ { "name": "Get A Process Tree", "id": "f8e9efb1-0779-4861-8537-3a9879d43853", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/processtrees/:processTableId?context=parent", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "processtrees", ":processTableId" ], "query": [ { "description": "Context level for the process tree", "key": "context", "value": "parent" } ], "variable": [ { "id": "54448070-4e14-48b4-a7d8-789ae074307e", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" }, { "id": "80af102b-3110-4fa8-8838-b508c274d942", "key": "processTableId", "value": "", "description": "(Required) Process table identifier" } ] }, "description": "Retrieves the process tree for a specific process, showing parent, child, and sibling processes. Useful for understanding process lineage during investigations." }, "response": [ { "id": "f90b1529-3aea-4518-9851-d3db7fc01d73", "name": "Process tree retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/processtrees/:processTableId?context=parent", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "processtrees", ":processTableId" ], "query": [ { "description": "Context level for the process tree", "key": "context", "value": "parent" } ], "variable": [ { "key": "connectionId" }, { "key": "processTableId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"processTableId\": \"\",\n \"uniqueProcessId\": \"\",\n \"pid\": \"\",\n \"processPath\": \"\",\n \"processHash\": \"\",\n \"hashTypeName\": \"\",\n \"userName\": \"\",\n \"groupName\": \"\",\n \"createTime\": \"\",\n \"createTimeRaw\": \"\",\n \"endTime\": \"\",\n \"endTimeRaw\": \"\",\n \"exitCode\": \"\",\n \"parentProcessTableId\": \"\",\n \"childrenCount\": \"\",\n \"fileEventsCount\": \"\",\n \"networkEventsCount\": \"\",\n \"registryEventsCount\": \"\",\n \"processEventsCount\": \"\",\n \"dnsEventsCount\": \"\",\n \"driverEventsCount\": \"\",\n \"imageEventsCount\": \"\",\n \"securityEventsCount\": \"\",\n \"context\": \"\"\n },\n {\n \"id\": \"\",\n \"processTableId\": \"\",\n \"uniqueProcessId\": \"\",\n \"pid\": \"\",\n \"processPath\": \"\",\n \"processHash\": \"\",\n \"hashTypeName\": \"\",\n \"userName\": \"\",\n \"groupName\": \"\",\n \"createTime\": \"\",\n \"createTimeRaw\": \"\",\n \"endTime\": \"\",\n \"endTimeRaw\": \"\",\n \"exitCode\": \"\",\n \"parentProcessTableId\": \"\",\n \"childrenCount\": \"\",\n \"fileEventsCount\": \"\",\n \"networkEventsCount\": \"\",\n \"registryEventsCount\": \"\",\n \"processEventsCount\": \"\",\n \"dnsEventsCount\": \"\",\n \"driverEventsCount\": \"\",\n \"imageEventsCount\": \"\",\n \"securityEventsCount\": \"\",\n \"context\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f90b1529-3aea-4518-9851-d3db7fc01d73" }, { "id": "5f41160d-e3d3-487f-9b31-78ea7be91dd9", "name": "Connection or process not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/processtrees/:processTableId?context=parent", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "processtrees", ":processTableId" ], "query": [ { "description": "Context level for the process tree", "key": "context", "value": "parent" } ], "variable": [ { "key": "connectionId" }, { "key": "processTableId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-5f41160d-e3d3-487f-9b31-78ea7be91dd9" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f8e9efb1-0779-4861-8537-3a9879d43853" } ], "id": "1893b7b2-7931-40a5-9f04-d3ec29499de6", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-1893b7b2-7931-40a5-9f04-d3ec29499de6" } ], "id": "88634fae-a6b2-4af8-a6b8-b6dfb29ebfb4", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-88634fae-a6b2-4af8-a6b8-b6dfb29ebfb4" }, { "name": "file", "item": [ { "name": "Request A File Download From An Endpoint", "id": "d70d81f0-c61a-4c9d-afd5-71b107b7e82f", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"path\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/file", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "file" ], "variable": [ { "id": "110511d5-0d9d-4b8e-a563-62fb84b44904", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" } ] }, "description": "Initiates a file download from a connected endpoint. The file is transferred from the endpoint to the Tanium server for analysis." }, "response": [ { "id": "8a61c610-4eb5-42ad-a186-565d6b198d6e", "name": "File download request initiated", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"path\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/file", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "file" ], "variable": [ { "key": "connectionId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"taskId\": \"\",\n \"status\": \"\",\n \"startTime\": \"\",\n \"compress\": \"\",\n \"paths\": [\n \"\",\n \"\"\n ],\n \"connection\": {\n \"id\": \"\"\n }\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-8a61c610-4eb5-42ad-a186-565d6b198d6e" }, { "id": "59a61015-8610-4f29-a202-ac5f3e25f6ce", "name": "Connection not found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"path\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId/file", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId", "file" ], "variable": [ { "key": "connectionId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-59a61015-8610-4f29-a202-ac5f3e25f6ce" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-d70d81f0-c61a-4c9d-afd5-71b107b7e82f" } ], "id": "e4040175-b7e7-4745-ab14-37b1ddfbc155", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e4040175-b7e7-4745-ab14-37b1ddfbc155" }, { "name": "Get A Connection By ID", "id": "d35e4f75-d242-461f-ad52-baa80dafd92b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId" ], "variable": [ { "id": "96262e85-01eb-49f5-b062-b3646fd124f0", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection" } ] }, "description": "Retrieves the details and current status of a specific endpoint connection." }, "response": [ { "id": "ac494c2f-d088-4dfe-80f6-b22607e8343f", "name": "Connection retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId" ], "variable": [ { "key": "connectionId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"hostname\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"status\": \"\",\n \"initiatedAt\": \"\",\n \"connectedAt\": \"\",\n \"message\": \"\",\n \"clientId\": \"\",\n \"userId\": \"\",\n \"eid\": \"\",\n \"personaId\": \"\",\n \"hasTools\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ac494c2f-d088-4dfe-80f6-b22607e8343f" }, { "id": "89b7df90-341a-4d82-abd3-d42d34b8467b", "name": "Connection not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", ":connectionId" ], "variable": [ { "key": "connectionId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-89b7df90-341a-4d82-abd3-d42d34b8467b" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-d35e4f75-d242-461f-ad52-baa80dafd92b" } ], "id": "e59d7422-05f6-4dd0-80a9-7c795f27d066", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e59d7422-05f6-4dd0-80a9-7c795f27d066" }, { "name": "close", "item": [ { "name": "{connectionId}", "item": [ { "name": "Close A Live Connection", "id": "664a1352-85c4-4571-90d3-eb0ce802f670", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/close/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "close", ":connectionId" ], "variable": [ { "id": "95f9cda0-c799-4eb8-80f7-bb858eb447ca", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection to close" } ] }, "description": "Closes an active live connection to an endpoint, ending the investigation session." }, "response": [ { "id": "15febfb2-f273-4343-a58c-c693c94b85ba", "name": "Connection closed successfully", "originalRequest": { "method": "POST", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/close/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "close", ":connectionId" ], "variable": [ { "key": "connectionId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-15febfb2-f273-4343-a58c-c693c94b85ba" }, { "id": "7e373e95-de73-45c3-b471-69635ce04692", "name": "Connection not found", "originalRequest": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/close/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "close", ":connectionId" ], "variable": [ { "key": "connectionId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7e373e95-de73-45c3-b471-69635ce04692" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-664a1352-85c4-4571-90d3-eb0ce802f670" } ], "id": "bee72bc4-0f91-413b-a72b-40abe757c9a0", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-bee72bc4-0f91-413b-a72b-40abe757c9a0" } ], "id": "698e3a0b-08f1-4bd8-938a-148c91290dae", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-698e3a0b-08f1-4bd8-938a-148c91290dae" }, { "name": "delete", "item": [ { "name": "{connectionId}", "item": [ { "name": "Delete A Connection Record", "id": "4f460dbd-17af-4fc4-9700-1db3644ea9e2", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/delete/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "delete", ":connectionId" ], "variable": [ { "id": "a54abd4d-6af2-47df-ad52-e778a3311cef", "key": "connectionId", "value": "", "description": "(Required) Unique identifier of the connection to delete" } ] }, "description": "Permanently deletes a connection record from the Threat Response database." }, "response": [ { "id": "3cecff69-c826-4007-82fb-5cbb3a3f8fd4", "name": "Connection deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/delete/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "delete", ":connectionId" ], "variable": [ { "key": "connectionId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3cecff69-c826-4007-82fb-5cbb3a3f8fd4" }, { "id": "1fb32942-64c8-409a-97fa-6bac85c04397", "name": "Connection not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns/delete/:connectionId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns", "delete", ":connectionId" ], "variable": [ { "key": "connectionId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-1fb32942-64c8-409a-97fa-6bac85c04397" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-4f460dbd-17af-4fc4-9700-1db3644ea9e2" } ], "id": "7988f3d6-6f56-473d-b5f6-556f3ead41c5", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7988f3d6-6f56-473d-b5f6-556f3ead41c5" } ], "id": "56bb05fa-6e6a-4442-925f-9b3cb07e3637", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-56bb05fa-6e6a-4442-925f-9b3cb07e3637" }, { "name": "List Endpoint Connections", "id": "532144fd-02b4-420c-b4af-ca21891a1a6d", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns?limit=&offset=&status=&ip=&platform=&hostname=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns" ], "query": [ { "description": "Maximum number of connections to return", "key": "limit", "value": "" }, { "description": "Number of connections to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by connection status", "key": "status", "value": "" }, { "description": "Filter by endpoint IP address", "key": "ip", "value": "" }, { "description": "Filter by endpoint platform", "key": "platform", "value": "" }, { "description": "Filter by endpoint hostname", "key": "hostname", "value": "" } ] }, "description": "Retrieves a paginated list of live connections to endpoints. Connections can be filtered by status, IP address, platform, and hostname." }, "response": [ { "id": "ee284a28-b063-40ac-aeaa-b84ddfc9bb74", "name": "Connections retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns?limit=&offset=&status=&ip=&platform=&hostname=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns" ], "query": [ { "description": "Maximum number of connections to return", "key": "limit", "value": "" }, { "description": "Number of connections to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by connection status", "key": "status", "value": "" }, { "description": "Filter by endpoint IP address", "key": "ip", "value": "" }, { "description": "Filter by endpoint platform", "key": "platform", "value": "" }, { "description": "Filter by endpoint hostname", "key": "hostname", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"hostname\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"status\": \"\",\n \"initiatedAt\": \"\",\n \"connectedAt\": \"\",\n \"message\": \"\",\n \"clientId\": \"\",\n \"userId\": \"\",\n \"eid\": \"\",\n \"personaId\": \"\",\n \"hasTools\": \"\"\n },\n {\n \"id\": \"\",\n \"hostname\": \"\",\n \"ip\": \"\",\n \"platform\": \"\",\n \"status\": \"\",\n \"initiatedAt\": \"\",\n \"connectedAt\": \"\",\n \"message\": \"\",\n \"clientId\": \"\",\n \"userId\": \"\",\n \"eid\": \"\",\n \"personaId\": \"\",\n \"hasTools\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ee284a28-b063-40ac-aeaa-b84ddfc9bb74" }, { "id": "22f20b6a-4531-4392-9932-b6379880aab7", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/conns?limit=&offset=&status=&ip=&platform=&hostname=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "conns" ], "query": [ { "description": "Maximum number of connections to return", "key": "limit", "value": "" }, { "description": "Number of connections to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by connection status", "key": "status", "value": "" }, { "description": "Filter by endpoint IP address", "key": "ip", "value": "" }, { "description": "Filter by endpoint platform", "key": "platform", "value": "" }, { "description": "Filter by endpoint hostname", "key": "hostname", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-22f20b6a-4531-4392-9932-b6379880aab7" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-532144fd-02b4-420c-b4af-ca21891a1a6d" } ], "id": "0ac50811-a231-4697-b3a8-59b45ed1896a", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-0ac50811-a231-4697-b3a8-59b45ed1896a" }, { "name": "snapshot", "item": [ { "name": "{snapshotId}", "item": [ { "name": "Delete A Local Snapshot", "id": "e75c93d3-5390-45c1-b429-fdb407602a0e", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot/:snapshotId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot", ":snapshotId" ], "variable": [ { "id": "a0113ad9-175c-4b1d-ac7d-dc26ad22a8fc", "key": "snapshotId", "value": "", "description": "(Required) Unique identifier of the snapshot to delete" } ] }, "description": "Deletes a specific snapshot stored locally on the Tanium server, freeing disk space." }, "response": [ { "id": "5422cf6a-b297-4680-9775-85a992e1bbc9", "name": "Local snapshot deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot/:snapshotId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot", ":snapshotId" ], "variable": [ { "key": "snapshotId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-5422cf6a-b297-4680-9775-85a992e1bbc9" }, { "id": "93ed2c07-6e8a-4bdb-bf3f-f0818e2c8845", "name": "Snapshot not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot/:snapshotId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot", ":snapshotId" ], "variable": [ { "key": "snapshotId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-93ed2c07-6e8a-4bdb-bf3f-f0818e2c8845" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e75c93d3-5390-45c1-b429-fdb407602a0e" } ], "id": "a943da1a-5249-4fb2-8ed7-65ce58774e6a", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-a943da1a-5249-4fb2-8ed7-65ce58774e6a" }, { "name": "List All Snapshots", "id": "b6654de9-3d1b-40f4-b7df-83ce6979ebdf", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot" ], "query": [ { "description": "Maximum number of snapshots to return", "key": "limit", "value": "" }, { "description": "Number of snapshots to skip for pagination", "key": "offset", "value": "" } ] }, "description": "Retrieves a paginated list of all endpoint snapshots captured for investigations." }, "response": [ { "id": "e014264e-8781-487f-aba4-c2436eb87b0b", "name": "Snapshots retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot" ], "query": [ { "description": "Maximum number of snapshots to return", "key": "limit", "value": "" }, { "description": "Number of snapshots to skip for pagination", "key": "offset", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"uuid\": \"\",\n \"name\": \"\",\n \"hostname\": \"\",\n \"connectionId\": \"\",\n \"evidenceType\": \"\",\n \"size\": \"\",\n \"isUpload\": \"\",\n \"recorderVersion\": \"\",\n \"created\": \"\",\n \"completed\": \"\"\n },\n {\n \"uuid\": \"\",\n \"name\": \"\",\n \"hostname\": \"\",\n \"connectionId\": \"\",\n \"evidenceType\": \"\",\n \"size\": \"\",\n \"isUpload\": \"\",\n \"recorderVersion\": \"\",\n \"created\": \"\",\n \"completed\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e014264e-8781-487f-aba4-c2436eb87b0b" }, { "id": "6e6eb51a-4520-4b51-8fad-f06af4cd2c93", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot" ], "query": [ { "description": "Maximum number of snapshots to return", "key": "limit", "value": "" }, { "description": "Number of snapshots to skip for pagination", "key": "offset", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6e6eb51a-4520-4b51-8fad-f06af4cd2c93" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-b6654de9-3d1b-40f4-b7df-83ce6979ebdf" }, { "name": "Delete Snapshots", "id": "5caf7df5-1d1b-44ef-ac27-9387d1d0b6d6", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"ids\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot" ] }, "description": "Deletes one or more snapshots by their identifiers. Provide snapshot IDs in the request body." }, "response": [ { "id": "818bb366-3716-49a8-82ca-842e8e5c56ad", "name": "Snapshots deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"ids\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-818bb366-3716-49a8-82ca-842e8e5c56ad" }, { "id": "0266adf5-cd52-42cc-a359-7ed5733a6769", "name": "One or more snapshots not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"ids\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/snapshot", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "snapshot" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-0266adf5-cd52-42cc-a359-7ed5733a6769" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-5caf7df5-1d1b-44ef-ac27-9387d1d0b6d6" } ], "id": "15be8008-8c9f-4afa-84a6-bed086d8bcc0", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-15be8008-8c9f-4afa-84a6-bed086d8bcc0" }, { "name": "filedownload", "item": [ { "name": "{fileId}", "item": [ { "name": "Get File Download Metadata", "id": "4bd882a3-ebc4-4eef-89df-247dd7518454", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", ":fileId" ], "variable": [ { "id": "7b7071fb-6d9d-40a7-bffe-00e204e6a7b9", "key": "fileId", "value": "", "description": "(Required) Unique identifier of the downloaded file" } ] }, "description": "Retrieves metadata for a specific downloaded file, including hash values, size, and origin information." }, "response": [ { "id": "f73696fd-e9bb-4154-89a5-f634f605b0fc", "name": "File download metadata retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", ":fileId" ], "variable": [ { "key": "fileId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"uuid\": \"\",\n \"path\": \"\",\n \"hostname\": \"\",\n \"hash\": \"\",\n \"size\": \"\",\n \"evidenceType\": \"\",\n \"downloaded\": \"\",\n \"processCreationTime\": \"\",\n \"createdBy\": \"\",\n \"createdByProc\": \"\",\n \"lastModified\": \"\",\n \"lastModifiedBy\": \"\",\n \"lastModifiedByProc\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f73696fd-e9bb-4154-89a5-f634f605b0fc" }, { "id": "15cfc454-3780-4b82-bb66-8f16cc690be1", "name": "File download not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", ":fileId" ], "variable": [ { "key": "fileId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-15cfc454-3780-4b82-bb66-8f16cc690be1" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-4bd882a3-ebc4-4eef-89df-247dd7518454" }, { "name": "Delete A Downloaded File", "id": "0fa9d744-b842-400e-9dde-87b7df9ce3a8", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", ":fileId" ], "variable": [ { "id": "7e385c07-4e65-4f13-a55d-53f20bb5e738", "key": "fileId", "value": "", "description": "(Required) Unique identifier of the file to delete" } ] }, "description": "Deletes a previously downloaded file from the Tanium server, freeing storage space." }, "response": [ { "id": "459efeaf-2eea-4b7a-acd5-69f91044b2bb", "name": "File download deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", ":fileId" ], "variable": [ { "key": "fileId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-459efeaf-2eea-4b7a-acd5-69f91044b2bb" }, { "id": "8464028b-c02f-4e02-af5f-33cf6cd3ee60", "name": "File download not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", ":fileId" ], "variable": [ { "key": "fileId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-8464028b-c02f-4e02-af5f-33cf6cd3ee60" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-0fa9d744-b842-400e-9dde-87b7df9ce3a8" } ], "id": "6d6bfad9-bfde-42bc-999d-98514f1993f0", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6d6bfad9-bfde-42bc-999d-98514f1993f0" }, { "name": "data", "item": [ { "name": "{fileId}", "item": [ { "name": "Download File Content", "id": "74902bc9-df5c-4ca0-b43c-b8651877dac5", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/octet-stream" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/data/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", "data", ":fileId" ], "variable": [ { "id": "9cbf0fe5-fffa-4e0a-95dc-f8f65b9e5121", "key": "fileId", "value": "", "description": "(Required) Unique identifier of the file to download" } ] }, "description": "Downloads the actual file content of a previously captured file. The file is returned as a binary download, password-protected with the default password \"infected\"." }, "response": [ { "id": "3285f6fc-af4a-4849-9b17-742f3a9bd4de", "name": "File content downloaded successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/octet-stream" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/data/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", "data", ":fileId" ], "variable": [ { "key": "fileId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [ { "key": "Content-Type", "value": "application/octet-stream" } ], "cookie": [], "responseTime": null, "body": "", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3285f6fc-af4a-4849-9b17-742f3a9bd4de" }, { "id": "f3735cab-4a5f-45df-ba16-a2eb3735d9aa", "name": "File not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload/data/:fileId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload", "data", ":fileId" ], "variable": [ { "key": "fileId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f3735cab-4a5f-45df-ba16-a2eb3735d9aa" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-74902bc9-df5c-4ca0-b43c-b8651877dac5" } ], "id": "dbfb94d5-4452-4641-9bb2-4e0d8caa4e2e", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-dbfb94d5-4452-4641-9bb2-4e0d8caa4e2e" } ], "id": "3b3211bb-d270-41b3-852e-b24f91368d7a", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3b3211bb-d270-41b3-852e-b24f91368d7a" }, { "name": "List File Downloads", "id": "ec817a1b-5cbb-49c1-98af-4a50f1320742", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload?limit=&offset=&sort=&hostname=&hash=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload" ], "query": [ { "description": "Maximum number of file downloads to return", "key": "limit", "value": "" }, { "description": "Number of file downloads to skip for pagination", "key": "offset", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Filter by source endpoint hostname", "key": "hostname", "value": "" }, { "description": "Filter by file hash", "key": "hash", "value": "" } ] }, "description": "Retrieves a paginated list of files that have been downloaded from endpoints during investigations." }, "response": [ { "id": "2a78aba0-9161-4e5c-ba54-98580744c656", "name": "File downloads retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload?limit=&offset=&sort=&hostname=&hash=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload" ], "query": [ { "description": "Maximum number of file downloads to return", "key": "limit", "value": "" }, { "description": "Number of file downloads to skip for pagination", "key": "offset", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Filter by source endpoint hostname", "key": "hostname", "value": "" }, { "description": "Filter by file hash", "key": "hash", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"uuid\": \"\",\n \"path\": \"\",\n \"hostname\": \"\",\n \"hash\": \"\",\n \"size\": \"\",\n \"evidenceType\": \"\",\n \"downloaded\": \"\",\n \"processCreationTime\": \"\",\n \"createdBy\": \"\",\n \"createdByProc\": \"\",\n \"lastModified\": \"\",\n \"lastModifiedBy\": \"\",\n \"lastModifiedByProc\": \"\"\n },\n {\n \"uuid\": \"\",\n \"path\": \"\",\n \"hostname\": \"\",\n \"hash\": \"\",\n \"size\": \"\",\n \"evidenceType\": \"\",\n \"downloaded\": \"\",\n \"processCreationTime\": \"\",\n \"createdBy\": \"\",\n \"createdByProc\": \"\",\n \"lastModified\": \"\",\n \"lastModifiedBy\": \"\",\n \"lastModifiedByProc\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-2a78aba0-9161-4e5c-ba54-98580744c656" }, { "id": "7cd2b89f-b7bf-43c6-bf0e-cf9d848b958b", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/filedownload?limit=&offset=&sort=&hostname=&hash=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "filedownload" ], "query": [ { "description": "Maximum number of file downloads to return", "key": "limit", "value": "" }, { "description": "Number of file downloads to skip for pagination", "key": "offset", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Filter by source endpoint hostname", "key": "hostname", "value": "" }, { "description": "Filter by file hash", "key": "hash", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7cd2b89f-b7bf-43c6-bf0e-cf9d848b958b" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ec817a1b-5cbb-49c1-98af-4a50f1320742" } ], "id": "b179f5b6-ee72-45c2-b12d-385bad5c5043", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-b179f5b6-ee72-45c2-b12d-385bad5c5043" }, { "name": "intels", "item": [ { "name": "{intelDocId}", "item": [ { "name": "labels", "item": [ { "name": "List Labels For An Intel Document", "id": "80299c6e-be41-4dde-8b48-2ab98bba7d13", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId/labels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId", "labels" ], "variable": [ { "id": "f57495dc-cd15-4949-b2ba-34e613ad5777", "key": "intelDocId", "value": "", "description": "(Required) Unique identifier of the intel document" } ] }, "description": "Retrieves the labels associated with a specific intel document. Labels categorize and organize intel documents for easier management." }, "response": [ { "id": "dce297a5-9fb8-4dd7-a83f-3f57befadffe", "name": "Labels retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId/labels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId", "labels" ], "variable": [ { "key": "intelDocId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"intelDocId\": \"\",\n \"labels\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-dce297a5-9fb8-4dd7-a83f-3f57befadffe" }, { "id": "2dedbedf-82db-407a-825b-921368747d6c", "name": "Intel document not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId/labels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId", "labels" ], "variable": [ { "key": "intelDocId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-2dedbedf-82db-407a-825b-921368747d6c" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-80299c6e-be41-4dde-8b48-2ab98bba7d13" }, { "name": "Add A Label To An Intel Document", "id": "d298a63e-b384-423a-82c5-4cc9ff889fad", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"label_id\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId/labels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId", "labels" ], "variable": [ { "id": "44f7d427-2831-4349-94a0-b4085f0e6198", "key": "intelDocId", "value": "", "description": "(Required) Unique identifier of the intel document" } ] }, "description": "Associates a label with an intel document for classification and organization purposes." }, "response": [ { "id": "d3cd6c02-6edd-4592-9125-d18275e9666e", "name": "Label added successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"label_id\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId/labels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId", "labels" ], "variable": [ { "key": "intelDocId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"intelDocId\": \"\",\n \"labels\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-d3cd6c02-6edd-4592-9125-d18275e9666e" }, { "id": "ded30b29-f040-45b1-af76-6d71574fbfc6", "name": "Intel document or label not found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"label_id\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId/labels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId", "labels" ], "variable": [ { "key": "intelDocId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ded30b29-f040-45b1-af76-6d71574fbfc6" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-d298a63e-b384-423a-82c5-4cc9ff889fad" } ], "id": "70bf28dd-ee06-47f3-a0af-4528643ed6f9", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-70bf28dd-ee06-47f3-a0af-4528643ed6f9" }, { "name": "Get An Intel Document By ID", "id": "e824b5c6-9abf-46a2-bbe2-532b158194bc", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId" ], "variable": [ { "id": "4b5abeb9-5226-4df4-943c-431a79083516", "key": "intelDocId", "value": "", "description": "(Required) Unique identifier of the intel document" } ] }, "description": "Retrieves the full details of a specific threat intelligence document including alert counts and label associations." }, "response": [ { "id": "0eecbf4c-ecd6-4fc4-acf2-43735e0c6a8e", "name": "Intel document retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId" ], "variable": [ { "key": "intelDocId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"alertCount\": \"\",\n \"unresolvedAlertCount\": \"\",\n \"labelIds\": [\n \"\",\n \"\"\n ],\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-0eecbf4c-ecd6-4fc4-acf2-43735e0c6a8e" }, { "id": "f205b4d2-0e74-44be-88da-4ca872967237", "name": "Intel document not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels/:intelDocId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels", ":intelDocId" ], "variable": [ { "key": "intelDocId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f205b4d2-0e74-44be-88da-4ca872967237" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e824b5c6-9abf-46a2-bbe2-532b158194bc" } ], "id": "700c3a98-db94-45b0-965f-adbff9415fa0", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-700c3a98-db94-45b0-965f-adbff9415fa0" }, { "name": "Upload An Intel Document", "id": "ad87bbd9-df46-4b37-930f-d5be7bd8f4cb", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"content\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels" ] }, "description": "Uploads a new threat intelligence document to Tanium Threat Response. Intel documents define indicators of compromise (IOCs) and threat signatures used for alerting and scanning." }, "response": [ { "id": "ca9444f0-a6a7-4375-8f72-d957d68b6bcd", "name": "Intel document uploaded successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"content\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"alertCount\": \"\",\n \"unresolvedAlertCount\": \"\",\n \"labelIds\": [\n \"\",\n \"\"\n ],\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ca9444f0-a6a7-4375-8f72-d957d68b6bcd" }, { "id": "868bb8bc-d1d6-40a9-ad81-f8ea33430a69", "name": "Invalid intel document format", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"content\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-868bb8bc-d1d6-40a9-ad81-f8ea33430a69" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ad87bbd9-df46-4b37-930f-d5be7bd8f4cb" }, { "name": "List Intel Documents", "id": "d6738b26-0c53-41f2-b126-a142618fd682", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels?limit=&offset=&name=&description=&type=&label_id=&mitre_technique_id=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels" ], "query": [ { "description": "Maximum number of intel documents to return", "key": "limit", "value": "" }, { "description": "Number of intel documents to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by intel document name", "key": "name", "value": "" }, { "description": "Filter by description text", "key": "description", "value": "" }, { "description": "Filter by intel document type", "key": "type", "value": "" }, { "description": "Filter by associated label identifier", "key": "label_id", "value": "" }, { "description": "Filter by MITRE ATT&CK technique ID", "key": "mitre_technique_id", "value": "" } ] }, "description": "Retrieves a paginated list of threat intelligence documents configured in Tanium Threat Response." }, "response": [ { "id": "a1eaed35-bcdf-4736-a3d0-714ea7ee4e7f", "name": "Intel documents retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels?limit=&offset=&name=&description=&type=&label_id=&mitre_technique_id=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels" ], "query": [ { "description": "Maximum number of intel documents to return", "key": "limit", "value": "" }, { "description": "Number of intel documents to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by intel document name", "key": "name", "value": "" }, { "description": "Filter by description text", "key": "description", "value": "" }, { "description": "Filter by intel document type", "key": "type", "value": "" }, { "description": "Filter by associated label identifier", "key": "label_id", "value": "" }, { "description": "Filter by MITRE ATT&CK technique ID", "key": "mitre_technique_id", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"alertCount\": \"\",\n \"unresolvedAlertCount\": \"\",\n \"labelIds\": [\n \"\",\n \"\"\n ],\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"type\": \"\",\n \"alertCount\": \"\",\n \"unresolvedAlertCount\": \"\",\n \"labelIds\": [\n \"\",\n \"\"\n ],\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-a1eaed35-bcdf-4736-a3d0-714ea7ee4e7f" }, { "id": "ad4833d4-8159-48bf-ac72-714e63c9f81b", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/intels?limit=&offset=&name=&description=&type=&label_id=&mitre_technique_id=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "intels" ], "query": [ { "description": "Maximum number of intel documents to return", "key": "limit", "value": "" }, { "description": "Number of intel documents to skip for pagination", "key": "offset", "value": "" }, { "description": "Filter by intel document name", "key": "name", "value": "" }, { "description": "Filter by description text", "key": "description", "value": "" }, { "description": "Filter by intel document type", "key": "type", "value": "" }, { "description": "Filter by associated label identifier", "key": "label_id", "value": "" }, { "description": "Filter by MITRE ATT&CK technique ID", "key": "mitre_technique_id", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-ad4833d4-8159-48bf-ac72-714e63c9f81b" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-d6738b26-0c53-41f2-b126-a142618fd682" } ], "id": "6adc9a24-872b-4f83-9ad5-2f457d460fd2", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6adc9a24-872b-4f83-9ad5-2f457d460fd2" }, { "name": "labels", "item": [ { "name": "{labelId}", "item": [ { "name": "Get A Label By ID", "id": "26822378-a810-4d4c-8deb-5d82d3a18459", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/labels/:labelId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "labels", ":labelId" ], "variable": [ { "id": "cb6053d9-0aa9-43b9-9d48-b5472dbf9aa4", "key": "labelId", "value": "", "description": "(Required) Unique identifier of the label" } ] }, "description": "Retrieves the details of a specific label including associated indicator and signal counts." }, "response": [ { "id": "4c854942-bc63-41b4-b827-91df600e7eed", "name": "Label retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/labels/:labelId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "labels", ":labelId" ], "variable": [ { "key": "labelId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-4c854942-bc63-41b4-b827-91df600e7eed" }, { "id": "e09c2697-12f3-4afb-ac1a-ef7d09ffb9f6", "name": "Label not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/labels/:labelId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "labels", ":labelId" ], "variable": [ { "key": "labelId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e09c2697-12f3-4afb-ac1a-ef7d09ffb9f6" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-26822378-a810-4d4c-8deb-5d82d3a18459" } ], "id": "92648c58-7267-48ed-9163-76329d23c248", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-92648c58-7267-48ed-9163-76329d23c248" }, { "name": "List All Labels", "id": "48847f5b-08c5-49ec-b98f-23fb870f5bee", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/labels?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "labels" ], "query": [ { "description": "Maximum number of labels to return", "key": "limit", "value": "" }, { "description": "Number of labels to skip for pagination", "key": "offset", "value": "" } ] }, "description": "Retrieves a paginated list of all labels available in Threat Response for categorizing intel documents and signals." }, "response": [ { "id": "24a557e6-1496-41fc-a521-51b4ebb0d7e9", "name": "Labels retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/labels?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "labels" ], "query": [ { "description": "Maximum number of labels to return", "key": "limit", "value": "" }, { "description": "Number of labels to skip for pagination", "key": "offset", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"name\": \"\",\n \"description\": \"\",\n \"indicatorCount\": \"\",\n \"signalCount\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-24a557e6-1496-41fc-a521-51b4ebb0d7e9" }, { "id": "7a14c129-cc87-4e05-81d6-4334c86ac92b", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/labels?limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "labels" ], "query": [ { "description": "Maximum number of labels to return", "key": "limit", "value": "" }, { "description": "Number of labels to skip for pagination", "key": "offset", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7a14c129-cc87-4e05-81d6-4334c86ac92b" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-48847f5b-08c5-49ec-b98f-23fb870f5bee" } ], "id": "563e0fdd-72b5-48db-b515-13d4c4f5f316", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-563e0fdd-72b5-48db-b515-13d4c4f5f316" }, { "name": "evidence", "item": [ { "name": "{evidenceId}", "item": [ { "name": "Get Evidence By ID", "id": "f798e2fe-d686-4c27-96d6-7b3f7c6b5d81", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/:evidenceId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", ":evidenceId" ], "variable": [ { "id": "38c4bdef-721e-4e33-b873-5b4f0e72acb9", "key": "evidenceId", "value": "", "description": "(Required) Unique identifier of the evidence" } ] }, "description": "Retrieves the full details of a specific evidence item including associated process information and timestamps." }, "response": [ { "id": "26caad20-8e71-48d6-9b5c-8779ab06aa56", "name": "Evidence retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/:evidenceId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", ":evidenceId" ], "variable": [ { "key": "evidenceId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": {\n \"uuid\": \"\",\n \"name\": \"\",\n \"hostname\": \"\",\n \"evidenceType\": \"\",\n \"type\": \"\",\n \"summary\": \"\",\n \"size\": \"\",\n \"username\": \"\",\n \"domain\": \"\",\n \"commandline\": \"\",\n \"eventtype\": \"\",\n \"timestamp\": \"\",\n \"createTime\": \"\",\n \"createTimeRaw\": \"\",\n \"exitCode\": \"\",\n \"createdAt\": \"\"\n }\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-26caad20-8e71-48d6-9b5c-8779ab06aa56" }, { "id": "4e954b28-d1b2-486d-9404-116326e99276", "name": "Evidence not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/:evidenceId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", ":evidenceId" ], "variable": [ { "key": "evidenceId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-4e954b28-d1b2-486d-9404-116326e99276" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-f798e2fe-d686-4c27-96d6-7b3f7c6b5d81" }, { "name": "Delete Evidence", "id": "06ab6ff0-79b1-4f33-8f3f-c321ee0dceef", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/:evidenceId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", ":evidenceId" ], "variable": [ { "id": "4b0b2189-4da1-40e9-83a7-8db7e82f32ce", "key": "evidenceId", "value": "", "description": "(Required) Evidence ID or comma-separated list of evidence IDs" } ] }, "description": "Deletes one or more evidence items. Multiple evidence IDs can be provided as a comma-separated list." }, "response": [ { "id": "e30e68ee-cdd1-4e24-9013-689adf75845f", "name": "Evidence deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/:evidenceId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", ":evidenceId" ], "variable": [ { "key": "evidenceId" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e30e68ee-cdd1-4e24-9013-689adf75845f" }, { "id": "e94fe765-ab99-49ef-9528-9a1608e48181", "name": "Evidence not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/:evidenceId", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", ":evidenceId" ], "variable": [ { "key": "evidenceId" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-e94fe765-ab99-49ef-9528-9a1608e48181" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-06ab6ff0-79b1-4f33-8f3f-c321ee0dceef" } ], "id": "bbddb224-9970-4a79-b53e-07ff996d5251", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-bbddb224-9970-4a79-b53e-07ff996d5251" }, { "name": "properties", "item": [ { "name": "Get Evidence Properties", "id": "3153f783-12f4-4842-ba24-5190eb947359", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/properties", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", "properties" ] }, "description": "Retrieves the available property definitions for evidence items, including filterable fields and their value types." }, "response": [ { "id": "7dfe362d-f2e9-41ee-9a0c-b79cc555d6fa", "name": "Evidence properties retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/properties", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", "properties" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"type\": \"\",\n \"value\": \"\"\n },\n {\n \"type\": \"\",\n \"value\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-7dfe362d-f2e9-41ee-9a0c-b79cc555d6fa" }, { "id": "b8ae7aa7-562b-4d38-8b19-356c84bada4f", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence/properties", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence", "properties" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-b8ae7aa7-562b-4d38-8b19-356c84bada4f" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3153f783-12f4-4842-ba24-5190eb947359" } ], "id": "a58ae795-9bad-4f93-a716-fddc393741ae", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-a58ae795-9bad-4f93-a716-fddc393741ae" }, { "name": "List Investigation Evidence", "id": "2ebd3b6b-5fd0-4633-b788-c43c57b37511", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence?limit=&offset=&sort=&hostname=&type=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence" ], "query": [ { "description": "Maximum number of evidence items to return", "key": "limit", "value": "" }, { "description": "Number of evidence items to skip for pagination", "key": "offset", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Filter by endpoint hostname", "key": "hostname", "value": "" }, { "description": "Filter by evidence type", "key": "type", "value": "" } ] }, "description": "Retrieves a paginated list of evidence collected during investigations. Evidence can be filtered by hostname and type." }, "response": [ { "id": "acc2463f-cd26-4fca-870c-973bccf95378", "name": "Evidence retrieved successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence?limit=&offset=&sort=&hostname=&type=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence" ], "query": [ { "description": "Maximum number of evidence items to return", "key": "limit", "value": "" }, { "description": "Number of evidence items to skip for pagination", "key": "offset", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Filter by endpoint hostname", "key": "hostname", "value": "" }, { "description": "Filter by evidence type", "key": "type", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"uuid\": \"\",\n \"name\": \"\",\n \"hostname\": \"\",\n \"evidenceType\": \"\",\n \"type\": \"\",\n \"summary\": \"\",\n \"size\": \"\",\n \"username\": \"\",\n \"domain\": \"\",\n \"commandline\": \"\",\n \"eventtype\": \"\",\n \"timestamp\": \"\",\n \"createTime\": \"\",\n \"createTimeRaw\": \"\",\n \"exitCode\": \"\",\n \"createdAt\": \"\"\n },\n {\n \"uuid\": \"\",\n \"name\": \"\",\n \"hostname\": \"\",\n \"evidenceType\": \"\",\n \"type\": \"\",\n \"summary\": \"\",\n \"size\": \"\",\n \"username\": \"\",\n \"domain\": \"\",\n \"commandline\": \"\",\n \"eventtype\": \"\",\n \"timestamp\": \"\",\n \"createTime\": \"\",\n \"createTimeRaw\": \"\",\n \"exitCode\": \"\",\n \"createdAt\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-acc2463f-cd26-4fca-870c-973bccf95378" }, { "id": "3d7a7541-512b-4d4e-a7e0-9ef6cb115f8b", "name": "Authentication required", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence?limit=&offset=&sort=&hostname=&type=", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence" ], "query": [ { "description": "Maximum number of evidence items to return", "key": "limit", "value": "" }, { "description": "Number of evidence items to skip for pagination", "key": "offset", "value": "" }, { "description": "Sort order for results", "key": "sort", "value": "" }, { "description": "Filter by endpoint hostname", "key": "hostname", "value": "" }, { "description": "Filter by evidence type", "key": "type", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-3d7a7541-512b-4d4e-a7e0-9ef6cb115f8b" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-2ebd3b6b-5fd0-4633-b788-c43c57b37511" }, { "name": "Create Evidence From A Process", "id": "c1e502dd-c9e3-47d2-9150-fcbafee6bfce", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"connection_id\": \"\",\n \"ptid\": \"\",\n \"hostname\": \"\",\n \"summary\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence" ] }, "description": "Creates an evidence record from a specific process on a connected endpoint, preserving investigation findings." }, "response": [ { "id": "52886d9a-dcc6-4ac6-a64a-2028d65b5ca3", "name": "Evidence created successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"connection_id\": \"\",\n \"ptid\": \"\",\n \"hostname\": \"\",\n \"summary\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-52886d9a-dcc6-4ac6-a64a-2028d65b5ca3" }, { "id": "5290c122-3091-4598-be2c-7665874e8a03", "name": "Invalid evidence parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "session", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"connection_id\": \"\",\n \"ptid\": \"\",\n \"hostname\": \"\",\n \"summary\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/plugin/products/threat-response/api/v1/evidence", "host": [ "{{baseUrl}}" ], "path": [ "plugin", "products", "threat-response", "api", "v1", "evidence" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"errors\": [\n {\n \"message\": \"\"\n },\n {\n \"message\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-5290c122-3091-4598-be2c-7665874e8a03" } ], "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-c1e502dd-c9e3-47d2-9150-fcbafee6bfce" } ], "id": "6e039777-621d-4f7a-989f-5bc095f6bfbe", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-6e039777-621d-4f7a-989f-5bc095f6bfbe" } ], "id": "c0a805a0-947a-4d1b-a09f-cf7c35033adc", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-c0a805a0-947a-4d1b-a09f-cf7c35033adc" } ], "id": "fd177e9c-4746-4e49-acd9-68bdda237bce", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-fd177e9c-4746-4e49-acd9-68bdda237bce" } ], "id": "fd3ef5dc-43d4-4a17-b5f1-40f58e245068", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-fd3ef5dc-43d4-4a17-b5f1-40f58e245068" } ], "id": "1dae4c61-76d3-4c2f-9fef-4ee69dcd3bbb", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-1dae4c61-76d3-4c2f-9fef-4ee69dcd3bbb" } ], "id": "51471a00-2ee0-450c-b6a8-0cfaf3729f4a", "createdAt": "2026-06-05T15:19:01.000Z", "updatedAt": "2026-06-05T15:19:01.000Z", "uid": "35240-51471a00-2ee0-450c-b6a8-0cfaf3729f4a" } ], "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "session", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "variable": [ { "key": "tanium_server", "value": "tanium.example.com" }, { "key": "baseUrl", "value": "https://{{tanium_server}}" } ] }