List Webhook templates for SIEM Connector

Select

SaaS

Customer Managed

This API returns the template for the SIEM Connector. Use the template for creating an SIEM Connector.

Responses

• 200

---

OK

application/json

• Schema
• Example (from schema)
• Example 1

---

Schema

• templates object[]

  List of templates

  name string

  policyTemplates object[]

  template string

  Webhook template

  dataType integer

  Type of template

  syslogTemplate string

  Template info

{
  "templates": [
    {
      "name": "string",
      "policyTemplates": [
        {
          "template": "string",
          "dataType": 0,
          "syslogTemplate": "string"
        }
      ]
    }
  ]
}

{
  "templates": [
    {
      "name": "Default",
      "policyTemplates": [
        {
          "template": "{\n    \"Alert Id\" : \"<ALERTID>\",\n    \"Alert name\" : \"<ALERTNAME>\",\n    \"Detected time\" : \"<ALERTTIME>\",\n    \"Severity\" : \"<ALERTSEVERITY>\",\n    \"Job Id\" : \"<JOBID>\",\n    \"Description\" : \"<ALERTDESCRIPTION>\",\n    \"Commcell name\" : \"<COMMCELLNAME>\",\n    \"Company name\" : \"<COMPANYNAME>\",\n    \"UTC Timestamp\" : \"<UTCTIMESTAMP>\"\n}",
          "dataType": 2,
          "syslogTemplate": "<<PRIVAL>>1 <FULL-DATE>T<FULL-TIME>Z <HOSTNAME> Commserver <PROCID> Alert [Alert@14604 AlertId=\"<ALERTID>\" AlertName=\"<ALERTNAME>\" DetectedTime=\"<ALERTTIME>\" JobId=\"<JOBID>\" CommcellName=\"<COMMCELLNAME>\" CompanyName=\"<COMPANYNAME>\" UTCTimestamp=\"<UTCTIMESTAMP>\"] <ALERTDESCRIPTION>"
        },
        {
          "template": "{\n    \"OpId\" : \"<OPID>\",\n    \"Audit Time\" : \"<AUDITTIME>\",\n    \"Severity\" : \"<SEVERITYLEVEL>\",\n    \"User\" : \"<USERNAME>\",\n    \"Operation\" : \"<OPERATION>\",\n    \"Details\" : \"<DETAILS>\",\n    \"Commcell name\" : \"<COMMCELLNAME>\",\n    \"Company name\" : \"<COMPANYNAME>\",\n    \"UTC Timestamp\" : \"<UTCTIMESTAMP>\"\n}",
          "dataType": 1,
          "syslogTemplate": "<<PRIVAL>>1 <FULL-DATE>T<FULL-TIME>Z <HOSTNAME> Commserver <PROCID> Audit [Audit@14604 OpId=\"<OPID>\" AuditTime=\"<AUDITTIME>\" User=\"<USERNAME>\" Operation=\"<OPERATION>\" CommcellName=\"<COMMCELLNAME>\" CompanyName=\"<COMPANYNAME>\" UTCTimestamp=\"<UTCTIMESTAMP>\"] <DETAILS>"
        },
        {
          "template": "{\n    \"Event Id\" : \"<EVENTID>\",\n    \"Occurrence Time\" : \"<OCCURRENCETIME>\",\n    \"Severity\" : \"<EVENTSEVERITY>\",\n    \"Computer\" : \"<COMPUTER>\",\n    \"Program\" : \"<PROGRAM>\",\n    \"Event Code\" : \"<EVENTCODE>\",\n    \"Description\" : \"<DESCRIPTION>\",\n    \"Commcell name\" : \"<COMMCELLNAME>\",\n    \"UTC Timestamp\" : \"<UTCTIMESTAMP>\"\n}",
          "dataType": 4,
          "syslogTemplate": "<<PRIVAL>>1 <FULL-DATE>T<FULL-TIME>Z <HOSTNAME> Commserver <PROCID> Event [Event@14604 EventId=\"<EVENTID>\" OccurrenceTime=\"<OCCURRENCETIME>\" Computer=\"<COMPUTER>\" Program=\"<PROGRAM>\" EventCode=\"<EVENTCODE>\" CommcellName=\"<COMMCELLNAME>\" UTCTimestamp=\"<UTCTIMESTAMP>\"] <DESCRIPTION>"
        }
      ]
    }
  ]
}

Loading...