To learn more, visit the Lacework documentation.

Parameters

ParameterDescription
End TimeQuery for changed files until given timestamp.
Start TimeQuery for changed files since given timestamp.

Example Output

{    "paging": {        "rows": 1000,        "totalRows": 3120,        "urls": {            "nextPage": "https://YourLacework.lacework.net/api/v2/Alerts/AbcdEfgh123..."        }    },    "data": [        {            "alertId": 855628,            "startTime": "2022-06-30T00:00:00.000Z",            "alertType": "MaliciousFile",            "severity": "Critical",            "internetExposure": "UnknownInternetExposure",            "reachability": "UnknownReachability",            "derivedFields": {                "category": "Anomaly",                "sub_category": "File",                "source": "Agent"            },            "endTime": "2022-06-30T01:00:00.000Z",            "lastUserUpdatedTime": "",            "status": "Open",            "alertName": "Clone of Cloud Activity log ingestion failure detected",            "alertInfo": {                "subject": "Clone of Cloud Activity log ingestion failure detected: `azure-al-india-dnd` (and `3` more) is failing for data ingestion into Lacework",                "description": "New integration failure detected for azure-al-india-dnd (and 3 more)"            },            "policyId": "CUSTOM_PLATFORM_130"        },        {            "alertId": 855629,            "startTime": "2022-06-30T00:00:00.000Z",            "alertType": "ChangedFile",            "severity": "Critical",            "internetExposure": "UnknownInternetExposure",            "reachability": "UnknownReachability",            "derivedFields": {                "category": "Policy",                "sub_category": "File",                "source": "Agent"            },            "endTime": "2022-06-30T01:00:00.000Z",            "lastUserUpdatedTime": "2022-06-30T01:26:51.392Z",            "status": "Open",            "alertName": "Unauthorized API Call",            "alertInfo": {                "subject": "Unauthorized API Call: For account: `1234567890`: Unauthorized API call was attempted `4` times",                "description": "For account: 1234567890: Unauthorized API call was attempted 4 times by user  ABCD1234:Lacework"            }        }    ]}

Workflow Library Example

List Alerts with Lacework and Send Results Via Email

Preview this Workflow on desktop