# Deep Security Manager REST API

## Name: Event

An Application Control event.

JSON Example:
    {"Event":
     {
       "action": 'unknown' | 'detect-only' | 'blocked',
       "blockReason": 'unknown' | 'blacklisted' | 'not-whitelisted',
       "eventID": Number,
       "fileName": String,
       "groupID": String,
       "groupName": String,
       "hostID": Number,
       "hostName": String,
       "logTime": Date,
       "md5": String,
       "path": String,
       "processID": Number,
       "processName": String,
       "rulesetID": Number,
       "sha1": String,
       "sha256": String,
       "tags": String,
       "userID": String,
       "userName": String,
     }
    }

Elements
Name | Type | Required | Default Value | Description
--- | --- | --- | --- | ---
action | 'unknown' | 'detect-only' | 'blocked' | Yes | `` | Get the action that was taken when the application was launched.
blockReason | 'unknown' | 'blacklisted' | 'not-whitelisted' | Yes | `` | Get the reason the application launch was blocked.
eventID | Number | Yes | `` | Get the event ID.
fileName | String | Yes | `` | Get the filename of the application that was blocked.
groupID | String | No | `` | Get the primary group ID of the user that launched the application that was blocked.
groupName | String | No | `` | Get the primary group name of the user that launched the application that was blocked.
hostID | Number | Yes | `` | Get the ID of the host where the application was blocked.
hostName | String | Yes | `` | Get the hostname of the host where the application was blocked.
logTime | Date | Yes | `` | Get the time at which the event was recorded.
md5 | String | Yes | `` | Get the MD5 hash of the application that was blocked.
path | String | Yes | `` | Get the path to the application that was launched.
processID | Number | No | `` | Get the process ID of the process that attempted to launch the application.
processName | String | Yes | `` | Get the process name of the process that attempted to launch the application.
rulesetID | Number | No | `` | Get the ruleset that is assigned to the host where the application was blocked.
sha1 | String | Yes | `` | Get the SHA-1 hash of the application that was blocked.
sha256 | String | Yes | `` | Get the SHA-256 hash of the application that was blocked.
tags | String | No | `` | Get the tags associated with the event. The tags will be returned in a comma-and-whitespace-separated list. For example, if an event has been tagged with `tag1` and `tag2`, then the returned string will be `tag1, tag2`.
userID | String | Yes | `` | Get the user ID of the user that attempted to launch the application.
userName | String | No | `` | Get the user name of the user that attempted to launch the application. NOTE: This is the system username, not necessarily a person's actual name. This ID will likely need to be mapped to an actual person through your identity management system.

Copyright © 2017 Trend Micro Inc. All Rights Reserved.