Event Ingestion
POST /events\nContent-Type: application/json\n\n{\n "event": {\n "timestamp": "2024-01-01T12:00:00Z",\n "source": "firewall",\n "event_type": "block",\n "payload": {\n "ip": "192.168.1.1",\n "action": "block"\n }\n }\n}
Endpoint Registration
POST /endpoints\nContent-Type: application/json\n\n{\n "endpoint": {\n "hostname": "server-01",\n "ip_address": "192.168.1.10",\n "os_type": "Linux",\n "os_version": "Ubuntu 22.04"\n }\n}
Search Query
POST /search\nContent-Type: application/json\n\n{\n "query": "source=firewall | stats count by event_type",\n "limit": 100\n}
Heartbeat
POST /endpoints/:id/heartbeat
Collect Telemetry
POST /endpoints/:id/collect_telemetry\n{\n "type": "all" // or "process", "file", "network"\n}