Cloud ConnectorsOpen API

{
   "id":"string",
   "name":"string", # max of 64 characters
   "description":"string",
   "application":"string",
   "tenant":{
      "id":"string",
      "name":"string"
   },
   "authn-data":{
      "type":"BASIC",
      "fields":[
         {
            "name":"string",
            "value":"string"
         },
         "..."
      ]
   }
}

{
   "id":"string", # unique id of account
   "tenant":{
      "id":"string",
      "name":"string"
   },
   "name":"string", # name given to account during onboard. e.g. MyAWS E
   "application":"string", # name of service. e.g. AWS
   "status":"StatusSummary", # "worst active endpoint"
   "is-active":"boolean", # true when the account is in "RUNNING" status; false otherwise
   "endpoint-status":"Array<EndpointStatus>"
}

{
   "account":{
      "src-tenant-id":"string", # tenant ID from which the account was exported
      "src-tenant-name":"string", # tenant name from which the account was exported
      "src-account-id":"string", # account ID in the SkyFormation server from which it was exported
      "name":"string", # account name
      "service":"string", # service name
      "description":"string", # optional 
      "active":"boolean", # account activation state
      "dlp-active":"boolean", # account DLP activation state
      "malware-active":"boolean", # account malware activation state
      "identity-reconciliation-rule":"JSON object", # identity reconciliation rule, optional
      "account-settings":"JSON object" # account settings
      "authn-data":"JSON object" # account authentication data
   },
   "mng-data":"JSON object" # account latest runtime information from the Exabeam Cloud Connector server from which it was exported"
}

{
   "name":"string", # Unique name of endpoint
   "health-status":"StatusSummary",
   "is-active":"boolean",
   "last-successful-sync":"SyncResult",
   "latest-syncs":"List<SyncResult>" # up to last 3 syncs, successful and errornous, sorted by update time, desc.
}

{ 
   "result-size": long, number of events retreived, 
   "total-sync-time": long, sec of duration, e.g. 60.000000, 
   "sync-date": double, sec since epoch, e.g. 1500207395.152, 
   "earliest-retrieved": long, sec since epoch, e.g. 1500194885, date of earliest event retrieved in the sync result, 
   "latest-retrieved": long, sec since epoch, e.g. 1500194885, date of latest event retreived in the sync result, 
   "earliest-requested": long, sec since epoch, e.g. 1500194885, date of earliest event requested to be synced, 
   "latest-requested": long, sec since epoch, e.g. 1500194885, date of latest event requested to be synced, 
   "result": StatusSummary 
}

{
   "state":"enum string", # "OK|WARN|ERROR"
   "cause":"string", # optional, present when WARN or ERROR, describes the reason for the state
   "locked-until":"number", # optional, present when in ERROR due to account lock, describes future unlock time; since 2.2.4; e.g. 1516195097.449
}

{
   "id":"string",
   "full-name":"string", # display name of the user
   "username":"string", 
   "email":"string",
   "last-login":"string", # optional
   "status":"enum string", # "locked_out|suspended|dormant|active"
}

{
    "user-identity-assignment": JSON object, when user reconciliation is configured, defines the LDAP/AD user property to be sent accross all events as a user identifier (null by default),
    "failover-enabled": boolean, enable/disable account recovery machanism (true by default),
    "global-sync-target": string, ["siem" | "local-bus"], decides whether events synced from all accounts, accross all endpoints, would be sent to a local event bus ("local-bus") or be sent directly to the configured SIEM. If defined it overrides the configured sync target at the level of each of endpoints (null by default)  
}

{  
  "scope": enum string, public|public_authenticated,  
  "path": string,  
  "content-modified-time": date, time in epoch milli  
  "last-modified-time": date, time in epoch milli  
  "content-type": string,  
  "creation-time": date, time in epoch milli  
  "owner": {  
    "type": string, email|user name  
    "value": string  
  },  
  "expiration-time": date, time in epoch milli  
  "name": string,  
  "resource-type": string, file|folder  
  "is-container": boolean,  
  "size": long, size in bytes  
  "classification": string, data classification type for sensitive data  
  "shared-with-users": Array of user details that the file was shared with  
  [  
    {  
      "type": string, email|user name,  
      "value": string  
    },  
    {  
      "type": string, email|user name,  
      "value": string  
    }  
    ...  
  ],  
  "app-specific-property-bag" : {  
     "key" : "value",  
     ...  
  }  
} 

Formal JSON Schema

{
    "$schema": "http://json-schema.org/draft-07/schema#",
    "definitions": {
        "AccountResetFilter": {
            "properties": {
                "type": {
                    "enum": [
                        "all",
                        "some"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        },
        "AccountResetFilterUnion": {
            "anyOf": [
                {
                    "$ref": "#/definitions/Some"
                },
                {
                    "$ref": "#/definitions/All"
                }
            ]
        },
        "All": {
            "properties": {
                "type": {
                    "enum": [
                        "all"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        },
        "EndpointCondition": {
            "properties": {
                "type": {
                    "enum": [
                        "exact",
                        "starts-with"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        },
        "EndpointConditionUnion": {
            "anyOf": [
                {
                    "$ref": "#/definitions/Exact"
                },
                {
                    "$ref": "#/definitions/StartsWith"
                }
            ]
        },
        "Exact": {
            "properties": {
                "name": {
                    "type": "string"
                },
                "type": {
                    "enum": [
                        "exact"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        },
        "Some": {
            "properties": {
                "endpoint-conditions": {
                    "items": {
                        "anyOf": [
                            {
                                "$ref": "#/definitions/Exact"
                            },
                            {
                                "$ref": "#/definitions/StartsWith"
                            }
                        ]
                    },
                    "type": "array"
                },
                "type": {
                    "enum": [
                        "some"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        },
        "StartsWith": {
            "properties": {
                "name": {
                    "type": "string"
                },
                "type": {
                    "enum": [
                        "starts-with"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        }
    }
}

Examples:

Reset all of an account’s endpoints:

{
    "type": "all"
}

Reset some of an account’s endpoints: Will reset the endpoint "my-endpoint" as well as all endpoint that start-with "my-other-endp" , e.g. "my-other-endpoint-1" and "my-other-endp"

{
    "type": "some",
    "endpoint-conditions": [
        {
            "type": "exact",
            "name": "my-endpoint"
        },
        {
            "type": "starts-with",
            "name": "my-other-endp"
        }
    ]
}

A list (array) of endpoint names that were successfully reset. e.g.

[
    "endpoint-1", "endpoint-2"
]