Detect early. Investigate faster. Respond with confidence.

Event Ingestion

POST /events\nContent-Type: application/json\n\n{\n  "event": {\n    "timestamp": "2024-01-01T12:00:00Z",\n    "source": "firewall",\n    "event_type": "block",\n    "payload": {\n      "ip": "192.168.1.1",\n      "action": "block"\n    }\n  }\n}

Endpoint Registration

POST /endpoints\nContent-Type: application/json\n\n{\n  "endpoint": {\n    "hostname": "server-01",\n    "ip_address": "192.168.1.10",\n    "os_type": "Linux",\n    "os_version": "Ubuntu 22.04"\n  }\n}

Search Query

POST /search\nContent-Type: application/json\n\n{\n  "query": "source=firewall | stats count by event_type",\n  "limit": 100\n}

Heartbeat

POST /endpoints/:id/heartbeat

Collect Telemetry

POST /endpoints/:id/collect_telemetry\n{\n  "type": "all"  // or "process", "file", "network"\n}