# Deep Security Manager REST API

## Path: / rest / events / integrity

Get Integrity events. Users can assign filters when querying events from DSM. The following are some notable behaviors that how DSM reacts:

DSM only accepts proper operator/operand pairs.
When only both an operator and an operand are properly assigned, DSM accepts the filter -- otherwise DSM ignores these improper parameters. Examples:

         eventID=100&eventIDOp='gt' -> a valid filter
         eventID=100 -> an invalid filter. DSM ignores it.
         eventIDOp='le' -> an invalid filter. DSM ignores it.

The output events are always sorted by ID in ascending.
DSM outputs results by counting the events from the smallest ID to the larger ID until the number of output events meets the maxItems; for instance, if DSM receives a request with either 'lt' or 'le' operator, firstly the API filter events by the filter, secondly it sorts the results by ID in ascending, and finally the API outputs events from the smallest ID until the number of output events meets the maxItems

In the database, the ordering of ID is not equal to the ordering of LogDate.
Sometimes DSM receives older events (e.g. yesterday's events), however, these older events' IDs are larger than newer events' IDs. When querying events by only time filter with 'ge' operator, DSM returns desired events and the corresponding lastEventID. However, it doesn't mean that in the database, all events whose ID larger than the lastEventID are older than the time filter in the query.

Resources
Name | Description
--- | ---
{eventID} | Get the Integrity event with the specified event ID.

Method Summary
Resource | Description
--- | ---
`GET /rest/events/integrity?eventID=…&eventIDOp=…&eventTime=…&eventTimeOp=…&maxItems=…&extendedDesc=…` | Get Integrity events.

Method Detail
Get Integrity events. Users can assign filters when querying events from DSM. The following are some notable behaviors that how DSM reacts: DSM only accepts proper operator/operand pairs. When only both an operator and an operand are properly assigned, DSM accepts the filter -- otherwise DSM ignores these improper parameters. Examples:
         eventID=100&eventIDOp='gt' -> a valid filter
         eventID=100 -> an invalid filter. DSM ignores it.
         eventIDOp='le' -> an invalid filter. DSM ignores it.
The output events are always sorted by ID in ascending. DSM outputs results by counting the events from the smallest ID to the larger ID until the number of output events meets the maxItems; for instance, if DSM receives a request with either 'lt' or 'le' operator, firstly the API filter events by the filter, secondly it sorts the results by ID in ascending, and finally the API outputs events from the smallest ID until the number of output events meets the maxItems In the database, the ordering of ID is not equal to the ordering of LogDate. Sometimes DSM receives older events (e.g. yesterday's events), however, these older events' IDs are larger than newer events' IDs. When querying events by only time filter with 'ge' operator, DSM returns desired events and the corresponding lastEventID. However, it doesn't mean that in the database, all events whose ID larger than the lastEventID are older than the time filter in the query. Output: `ListEventsResponse` - ListEventsResponse, a collection of the events meet the given criteria. Query parameters: eventID - the event ID to query for events. Combined with eventIDOp, the returning events can be filtered according to the ID. eventIDOp - defined the events to return. Currently supported operations include gt(greater than), ge(greater than or equal to), eq(eqaul to), lt(less than), and le(less than or equal to). If an unsupported operator is provided, the default is 'eq'. eventTime - the event time to query for events. It is represented by a long integer, which is the milliseconds since January 1, 1970, 00:00:00 GMT. Combined with eventTimeOp, the returning events can be filtered by the specific milliseconds. Please be aware that for integrity events, the accuracy of event time is millisecond. In other words, if you want to exactly filter events by event time, the eventTime value must be millisecond accuracy. eventTimeOp - defined the events to return. Currently supported operations include gt(greater than), ge(greater than or equal to), eq(eqaul to), lt(less than), and le(less than or equal to). If an unsupported operator is provided, the default is 'eq'. maxItems - the maximum events to response. The minimum valid value is 1. extendedDesc - provide more information about the affected entities and related attributes (default is "false") Cookie parameters: sID - a session ID returned by the Authentication API. Produces: application/json application/xml

Copyright © 2017 Trend Micro Inc. All Rights Reserved.