Alert Events

Overview

Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Agari DMARC Protection.

Configuration

Parameters

• parameters.domain will store the value of the API URL, excluding the endpoint paths like /v1/cp/oauth/token or /v1/cp/alert_events

Secrets

• secrets.client_id will reference to Agari's Client ID

• secrets.client_secret will reference to Agari's Client Secret.

After entering the required parameters and secrets, you can choose to manually enter the fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: ${parameters.domain}/v1/cp/oauth/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
      bodyType: urlEncoded
      bodyParams:
        - name: client_id
          value: '${secrets.client_id}'
        - name: client_secret
          value: '${secrets.client_secret}'
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: false
collectionPhase:
  paginationType: offsetLimit
  limit: 200
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/alert_events
    queryParams:
      - name: start_date
        value: ${temporalWindow.from}
      - name: end_date
        value: ${temporalWindow.to}
      - name: offset
        value: ${pagination.offset}
      - name: limit
        value: ${pagination.limit}
  output:
    select: ".alert_events"
    map: "."
    outputMode: element

Manually configure

This HTTP Pull Listener now uses the data export API to extract alert events.

Click Create labels to move on to the next step and define the required Labels if needed.