List security events

POST

/events

Query and filter security events. Events represent security-related activities
such as data sharing, phishing interactions, OAuth app consents, device threats, etc.

Queryable fields: employee_email, happened, risk_score, source, allowlisted, high_prevalence, id, parent_id, event_type, ip_address.

Filtering by time range: Use the happened field with comparison operators to filter
events by when they occurred. For example: happened >= '2024-01-01'

Filtering by event type: Filter by event type using =, !=, or IN. For example:
event_type = 'shadow_it' or event_type IN ('shadow_it', 'mfa'). Only exact enum
string values are supported; LIKE patterns are not supported for this field.

Filtering by IP address: Filter by the source IPv4 address of the event using =, !=,
NOT, or IN. For example: ip_address = '203.0.113.42' or
ip_address IN ('10.0.0.1', '10.0.0.2').

Relations:

employee (Person): The person associated with the event

Request

Authorization

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/events' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

200 - Example 1

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "allowlisted": true,
            "asset_name": "ChatGPT",
            "description": "User accessed unauthorized application chatgpt.com",
            "device": {
                "activation_lock": "unspecified",
                "active_usb_connections": {
                    "composite_count": 0,
                    "hid_count": 2,
                    "kvm_count": 0,
                    "max_usb_risk_level": 1,
                    "network_adapter_count": 0,
                    "storage_count": 1,
                    "unknown_count": 0
                },
                "antivirus": "unspecified",
                "apps_installed": 47,
                "disk_encryption": "unspecified",
                "employee_email": "joe.smith@example.com",
                "employee_name": "Joe Smith",
                "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
                "last_seen": "2021-01-01T00:00:00Z",
                "last_usb_usage": "2021-01-01T00:00:00Z",
                "local_user_accounts": [
                    {
                        "admin": true,
                        "name": "John Doe",
                        "user_id": "S-1-5-21-1234567890-1234567890-1234567890-1001",
                        "username": "john.doe"
                    }
                ],
                "mac_addresses": [
                    "00:1B:44:11:3A:B7"
                ],
                "mdm": "unspecified",
                "model": "MacBook Pro",
                "name": "Joe's Mac",
                "platform": "windows",
                "risk_factors": [
                    {
                        "magnitude": 40,
                        "type": "sensitive_file"
                    }
                ],
                "risk_score": 9.2,
                "serial_number": "C02X1234DC79",
                "sources": [
                    "unspecified"
                ]
            },
            "dimension_event_count_total": 0,
            "dimensions": [
                "impossible_travel"
            ],
            "employee": {
                "categories": [
                    "automation"
                ],
                "departed_time": "2021-01-01T00:00:00Z",
                "department": "EPD",
                "email": "joe.smith@example.com",
                "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
                "job_category": "engineer",
                "job_title": "Engineer",
                "last_login": "2021-01-01T00:00:00Z",
                "location_city": "San Francisco",
                "location_country": "USA",
                "location_state": "CA",
                "manager_email": "john.lopez@example.com",
                "manager_name": "John Lopez",
                "name": "Joe Smith",
                "password_changed": "2021-01-01T00:00:00Z",
                "risk_factors": [
                    {
                        "magnitude": 40,
                        "type": "sensitive_file"
                    }
                ],
                "risk_score": 9.2,
                "state": "unspecified"
            },
            "employee_email": "joe.smith@example.com",
            "employee_name": "Joe Smith",
            "event_type": "shadow_it",
            "happened": "2024-01-15T10:30:00Z",
            "high_prevalence": true,
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "network_origin": {
                "geographic_location": {
                    "city": "San Francisco",
                    "country": "United States",
                    "country_code": "US",
                    "latitude": 0,
                    "longitude": 0,
                    "region": "California",
                    "timezone": "America/Los_Angeles"
                },
                "ip": "203.0.113.45",
                "network": {
                    "asn": "AS15169",
                    "asn_name": "Google LLC",
                    "host_type": [
                        "HOSTING",
                        "ANYCAST"
                    ]
                },
                "privacy": {
                    "privacy_mode": [
                        "VPN"
                    ],
                    "service_name": "NordVPN"
                }
            },
            "parent_id": "1c6ca187-e61f-4301-8dcb-0e9749e89eef",
            "risk_score": 9.2,
            "source": "unspecified",
            "web_host": {
                "allowlisted": true,
                "employee_email": "joe.smith@example.com",
                "employee_name": "Joe Smith",
                "event_types": [
                    "corporate_email_login"
                ],
                "external_id": "chatgpt.com",
                "host": "chatgpt.com",
                "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
                "last_seen": "2021-01-01T00:00:00Z",
                "login_count": 42,
                "risk_score": 9.2
            }
        }
    ]
}

Modified at 2026-07-28 15:47:54

List users associated with a given detection

Query all Shadow IT instances