REST API for Oracle CASB Cloud Service

Get user risk score report

get

/api/v1/reports/details/{reportName}

This call will retrieve the user risk score report. Filters can be applied using the query parameters.

Request

Supported Media Types

application/json

Path Parameters

reportName: string

The name of the report to be retrieved. Sample value is 'Userrisk'. This report name must be present as a path parameter.

Query Parameters

applicationInstanceName(optional): string

The name of the application instance from which the risk score report is to be retrieved. Default is to include all application instances.
applicationType(optional): string

Application type, such as 'AWS', 'BOX', 'SFDC', 'O365', 'Slack', 'ServiceNow', etc. Default is to include all application types.
markerPosition(optional): string

Marker position, indicating pagination, from which to begin retrieving the next set of records. This should be fetched from the response of the first request and used in subsequent requests.
pagesize: string

Page size in number of events. The maximum value allowed is 100.
userName(optional): string

The name of the user for which the risk score report is to be retrieved.

Header Parameters

Authorization: string

Contains authorization token receieved by making create token API call. The format is 'Bearer' followed by the token which starts with v2.
X-Apprity-Tenant-Id: string

The tenant ID for which you are making this call.

Response

Supported Media Types

application/json
application/gzip

200 Response

Successfully read user risk score.

Root Schema : ReportResponse

Type: object

Show Source

description(optional): string

The detailed description.
displayInstanceColumn(optional): boolean

If value passed was true, the Instance column is included in the report.
maxCount(optional): integer(int32)

Maximum page size, in records, to be returned. Default value is 100.
nextMarkerPosition(optional): string

Marker position, from which to begin retrieving the next set of risk details
reportId(optional): string

ID of the report for which results have been returned.
size(optional): integer(int32)

Number of records present in the response.
tenantName(optional): string

The name of the tenant from which the risk scores are reported.
title(optional): string

The short description.
totalCount(optional): integer(int64)

Total number of records returned.
userRiskScores(optional): array userRiskScores

The list of users and their associated risk scores.

{
    "type":"object",
    "properties":{
        "title":{
            "description":"The short description.",
            "type":"string"
        },
        "description":{
            "description":"The detailed description.",
            "type":"string"
        },
        "userRiskScores":{
            "description":"The list of users and their associated risk scores.",
            "type":"array",
            "items":{
                "$ref":"#/definitions/userRiskScores"
            }
        },
        "nextMarkerPosition":{
            "type":"string",
            "description":"Marker position, from which to begin retrieving the next set of risk details",
            "xml":{
                "name":"nextMarkerPosition",
                "attribute":true
            }
        },
        "tenantName":{
            "type":"string",
            "description":"The name of the tenant from which the risk scores are reported.",
            "xml":{
                "name":"tenantName",
                "attribute":true
            }
        },
        "reportId":{
            "type":"string",
            "description":"ID of the report for which results have been returned.",
            "xml":{
                "name":"reportId",
                "attribute":true
            }
        },
        "maxCount":{
            "type":"integer",
            "format":"int32",
            "description":"Maximum page size, in records, to be returned. Default value is 100.",
            "xml":{
                "name":"maxCount",
                "attribute":true
            }
        },
        "totalCount":{
            "type":"integer",
            "format":"int64",
            "description":"Total number of records returned.",
            "xml":{
                "name":"totalCount",
                "attribute":true
            }
        },
        "size":{
            "type":"integer",
            "format":"int32",
            "description":"Number of records present in the response.",
            "xml":{
                "attribute":true
            }
        },
        "displayInstanceColumn":{
            "type":"boolean",
            "description":"If value passed was true, the Instance column is included in the report.",
            "xml":{
                "name":"displayInstanceColumn",
                "attribute":true
            }
        }
    }
}

Nested Schema : userRiskScores

Type: array

The list of users and their associated risk scores.

Show Source

Array of: object userRiskScores

{
    "description":"The list of users and their associated risk scores.",
    "type":"array",
    "items":{
        "$ref":"#/definitions/userRiskScores"
    }
}

Nested Schema : userRiskScores

Type: object

Show Source

appinstance(optional): string

Application instance name for which the risk was detected.
appInstanceId(optional): string

Application instance ID for which the risk was detected.
appname(optional): string

Application type for which the risk was detected.
rowId(optional): string
userRiskDetails(optional): array userRiskDetails

Risk details that includes risk level, username, risk score, reasons for the risk, detected date, reasons and counts.

{
    "type":"object",
    "properties":{
        "userRiskDetails":{
            "description":"Risk details that includes risk level, username, risk score, reasons for the risk, detected date, reasons and counts.",
            "type":"array",
            "xml":{
                "name":"userRiskDetails"
            },
            "items":{
                "$ref":"#/definitions/userRiskDetails"
            }
        },
        "appname":{
            "description":"Application type for which the risk was detected.",
            "type":"string",
            "xml":{
                "attribute":true
            }
        },
        "appinstance":{
            "description":"Application instance name for which the risk was detected.",
            "type":"string",
            "xml":{
                "attribute":true
            }
        },
        "appInstanceId":{
            "description":"Application instance ID for which the risk was detected.",
            "type":"string",
            "xml":{
                "name":"appInstanceId",
                "attribute":true
            }
        },
        "rowId":{
            "type":"string",
            "xml":{
                "name":"rowId",
                "attribute":true
            }
        }
    }
}

Nested Schema : userRiskDetails

Type: array

Risk details that includes risk level, username, risk score, reasons for the risk, detected date, reasons and counts.

Show Source

Array of: object userRiskDetails

{
    "description":"Risk details that includes risk level, username, risk score, reasons for the risk, detected date, reasons and counts.",
    "type":"array",
    "xml":{
        "name":"userRiskDetails"
    },
    "items":{
        "$ref":"#/definitions/userRiskDetails"
    }
}

Nested Schema : userRiskDetails

Type: object

Show Source

displayname(optional): string

The report's display name
name(optional): string

The report's name
value(optional): string

The report's value

{
    "type":"object",
    "properties":{
        "name":{
            "description":"The report's name",
            "type":"string"
        },
        "displayname":{
            "description":"The report's display name",
            "type":"string"
        },
        "value":{
            "description":"The report's value",
            "type":"string"
        }
    }
}

400 Response

Bad request format. Check the response for more information on which fields are inaccurate. Ensure that you have a request which follows the format.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

401 Response

Unauthorized get API call. See response for more details.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

403 Response

Retrieving all user risk score events is forbidden. It is likely that the CASB APIs aren???t enabled for the tenant.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

404 Response

Requested Resource(instance ID) is not present.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

500 Response

Internal Server error occured. See response for more details.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

503 Response

Service is unavailable.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

504 Response

Gateway timed out. Please retry.

Root Schema : Error

Type: object

Show Source

code(optional): string

HTTP Status Code.
message(optional): string

The error message.

{
    "type":"object",
    "properties":{
        "code":{
            "description":"HTTP Status Code.",
            "type":"string"
        },
        "message":{
            "description":"The error message.",
            "type":"string"
        }
    }
}

Examples

The following example shows how to retrieve a user risk report by submitting a GET request.

Example Response Body: Retrieving a User Risk Report

The following example shows the contents of the response body in JSON format:

{
  "type": "ReportResponse",
  "tenantName": "e6d29a75-cdaf-4dfa-b35d-90c77899eb10",
  "reportId": "userrisk",
  "maxCount": 100,
  "totalCount": 6,
  "size": 6,
  "title": "Users at risk",
  "description": "User risk scores based on LORIC's analysis of suspicious activity patterns",
  "userRiskScores": [
    {
      "appname": "SFDC",
      "appinstance": "publiceventsapi",
      "appInstanceId": "bd4716ef-d9b3-4348-8793-347134edce7a",
      "userRiskDetails": [
        {
          "displayname": "Risk Level",
          "value": "Normal"
        },
        {
          "displayname": "User name",
          "value": "andylemarc@mycompany.com"
        },
        {
          "displayname": "Maximum Risk Score",
          "value": "00"
        },
        {
          "displayname": "Reasons",
          "value": "[\"bd4716ef-d9b3-4348-8793-347134edce7a\", \"2017-10-24T23:29:38Z\", {\"MSG_NO_RISK_FACTORS\":\"No risk factors\"}]"
        },
        {
          "displayname": "Detected Date",
          "value": "2017-10-24T00:00:00Z"
        },
        {
          "displayname": "ReasonsAverage",
          "value": "{}"
        },
        {
          "displayname": "ReasonsCounts",
          "value": "{}"
        },
        {
          "displayname": "Detected Date ISOFormat",
          "value": "2017-10-24T00:00:00Z"
        }
      ]
    },
    {
      "appname": "SFDC",
      "appinstance": "publiceventsapi",
      "appInstanceId": "bd4716ef-d9b3-4348-8793-347134edce7a",
      "userRiskDetails": [
        {
          "displayname": "Risk Level",
          "value": "Normal"
        },
        {
          "displayname": "User name",
          "value": "carlagomez@mycompany.com"
        },
        {
          "displayname": "Maximum Risk Score",
          "value": "00"
        },
        {
          "displayname": "Reasons",
          "value": "[\"bd4716ef-d9b3-4348-8793-347134edce7a\", \"2017-10-24T23:29:38Z\", {\"MSG_NO_RISK_FACTORS\":\"No risk factors\"}]"
        },
        {
          "displayname": "Detected Date",
          "value": "2017-10-24T00:00:00Z"
        },
        {
          "displayname": "ReasonsAverage",
          "value": "{}"
        },
        {
          "displayname": "ReasonsCounts",
          "value": "{}"
        },
        {
          "displayname": "Detected Date ISOFormat",
          "value": "2017-10-24T00:00:00Z"
        }
      ]
    },
    {
      "appname": "SFDC",
      "appinstance": "publiceventsapi",
      "appInstanceId": "bd4716ef-d9b3-4348-8793-347134edce7a",
      "userRiskDetails": [
        {
          "displayname": "Risk Level",
          "value": "Normal"
        },
        {
          "displayname": "User name",
          "value": "billwong@mycompany.com"
        },
        {
          "displayname": "Maximum Risk Score",
          "value": "00"
        },
        {
          "displayname": "Reasons",
          "value": "[\"bd4716ef-d9b3-4348-8793-347134edce7a\", \"2017-10-24T23:29:38Z\", {\"MSG_NO_RISK_FACTORS\":\"No risk factors\"}]"
        },
        {
          "displayname": "Detected Date",
          "value": "2017-10-24T00:00:00Z"
        },
        {
          "displayname": "ReasonsAverage",
          "value": "{}"
        },
        {
          "displayname": "ReasonsCounts",
          "value": "{}"
        },
        {
          "displayname": "Detected Date ISOFormat",
          "value": "2017-10-24T00:00:00Z"
        }
      ]
    },
    {
      "appname": "SFDC",
      "appinstance": "publiceventsapi",
      "appInstanceId": "bd4716ef-d9b3-4348-8793-347134edce7a",
      "userRiskDetails": [
        {
          "displayname": "Risk Level",
          "value": "Normal"
        },
        {
          "displayname": "User name",
          "value": "suelee@mycompany.com"
        },
        {
          "displayname": "Maximum Risk Score",
          "value": "00"
        },
        {
          "displayname": "Reasons",
          "value": "[\"bd4716ef-d9b3-4348-8793-347134edce7a\", \"2017-10-24T23:29:38Z\", {\"MSG_NO_RISK_FACTORS\":\"No risk factors\"}]"
        },
        {
          "displayname": "Detected Date",
          "value": "2017-10-24T00:00:00Z"
        },
        {
          "displayname": "ReasonsAverage",
          "value": "{}"
        },
        {
          "displayname": "ReasonsCounts",
          "value": "{}"
        },
        {
          "displayname": "Detected Date ISOFormat",
          "value": "2017-10-24T00:00:00Z"
        }
      ]
    },
    {
      "appname": "SFDC",
      "appinstance": "publiceventsapi",
      "appInstanceId": "bd4716ef-d9b3-4348-8793-347134edce7a",
      "userRiskDetails": [
        {
          "displayname": "Risk Level",
          "value": "Normal"
        },
        {
          "displayname": "User name",
          "value": "sashakopek@mycompany.com"
        },
        {
          "displayname": "Maximum Risk Score",
          "value": "00"
        },
        {
          "displayname": "Reasons",
          "value": "[\"bd4716ef-d9b3-4348-8793-347134edce7a\", \"2017-10-24T23:29:38Z\", {\"NETWRK_PREFIX_EVENTS\":\"Total IP network prefix for all events\"}]"
        },
        {
          "displayname": "Detected Date",
          "value": "2017-10-24T00:00:00Z"
        },
        {
          "displayname": "ReasonsAverage",
          "value": "{\"NETWRK_PREFIX_EVENTS\":\"1\"}"
        },
        {
          "displayname": "ReasonsCounts",
          "value": "{\"NETWRK_PREFIX_EVENTS\":\"1\"}"
        },
        {
          "displayname": "Detected Date ISOFormat",
          "value": "2017-10-24T00:00:00Z"
        }
      ]
    },
    {
      "appname": "SFDC",
      "appinstance": "publiceventsapi",
      "appInstanceId": "bd4716ef-d9b3-4348-8793-347134edce7a",
      "userRiskDetails": [
        {
          "displayname": "Risk Level",
          "value": "Normal"
        },
        {
          "displayname": "User name",
          "value": "leiamacintosh@mycompany.com"
        },
        {
          "displayname": "Maximum Risk Score",
          "value": "00"
        },
        {
          "displayname": "Reasons",
          "value": "[\"bd4716ef-d9b3-4348-8793-347134edce7a\", \"2017-10-24T23:29:38Z\", {\"NETWRK_PREFIX_EVENTS\":\"Total IP network prefix for all events\"}]"
        },
        {
          "displayname": "Detected Date",
          "value": "2017-10-24T00:00:00Z"
        },
        {
          "displayname": "ReasonsAverage",
          "value": "{\"NETWRK_PREFIX_EVENTS\":\"1\"}"
        },
        {
          "displayname": "ReasonsCounts",
          "value": "{\"NETWRK_PREFIX_EVENTS\":\"3\"}"
        },
        {
          "displayname": "Detected Date ISOFormat",
          "value": "2017-10-24T00:00:00Z"
        }
      ]
    }
  ]
}