{ "info": { "_postman_id": "530872b1-3f7b-4049-9037-daa3ecd19dc6", "name": "Unified Security Stack Alerts API Collection", "description": "Complete collection of Unified Security Stack Alert Management APIs including authentication, search, and CRUD operations for alerts.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_exporter_id": "26699686", "_collection_link": "https://go.postman.co/collection/26699686-530872b1-3f7b-4049-9037-daa3ecd19dc6?source=collection_link" }, "item": [ { "name": "Authentication", "item": [ { "name": "Login - Get Bearer Token", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "// Extract and store the bearer token", "if (pm.response.code === 200) {", " const response = pm.response.json();", " if (response.id_token) {", " pm.collectionVariables.set('bearerToken', response.id_token);", " pm.environment.set('bearerToken', response.id_token);", " console.log('Bearer token stored successfully');", " }", " ", " // Test assertions", " pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", " });", " ", " pm.test('Response contains id_token', function () {", " pm.expect(response).to.have.property('id_token');", " });", " ", " pm.test('Response contains authenticated flag', function () {", " pm.expect(response).to.have.property('authenticated');", " });", "}" ] } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"username\": \"demo\",\n \"password\": \"your_password\",\n \"rememberMe\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/authenticate", "host": [ "{{baseUrl}}" ], "path": [ "api", "authenticate" ] }, "description": "Authenticate with Unified Security Stack and obtain a JWT Bearer token for API access." }, "response": [] } ], "description": "Authentication endpoints for obtaining JWT tokens" }, { "name": "Alert Management", "item": [ { "name": "List Alerts", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response is an array', function () {", " const response = pm.response.json();", " pm.expect(response).to.be.an('object');", "});", "", "// Store first alert ID for other requests", "if (pm.response.code === 200) {", " const alerts = pm.response.json();", " if (alerts.length > 0 && alerts[0].id) {", " pm.collectionVariables.set('alertId', alerts[0].id);", " }", "}" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "[\n {\n \"field\": \"status\",\n \"operator\": \"IS_NOT\",\n \"value\": \"1\"\n },\n {\n \"field\": \"tags\",\n \"operator\": \"IS_NOT\",\n \"value\": \"False positive\"\n },\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-7d\",\n \"now\"\n ]\n }\n]", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/search?page=1&size=25&top=100000000&indexPattern=v1-7-22-alert-*&sort=@timestamp,desc", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "search" ], "query": [ { "key": "page", "value": "1", "description": "Current page number" }, { "key": "size", "value": "25", "description": "Number of results per page" }, { "key": "top", "value": "100000000", "description": "Maximum number of records" }, { "key": "indexPattern", "value": "v1-7-22-alert-*", "description": "Elasticsearch index pattern" }, { "key": "sort", "value": "@timestamp,desc", "description": "Sort field and direction" } ] }, "description": "Retrieve alerts from Elasticsearch with advanced filtering, pagination, and sorting capabilities." }, "response": [] }, { "name": "List Open Alerts Only", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "[\n {\n \"field\": \"status\",\n \"operator\": \"IS\",\n \"value\": \"2\"\n },\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-24h\",\n \"now\"\n ]\n }\n]", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/search?page=1&size=50&top=10000&indexPattern=v1-7-22-alert-*&sort=@timestamp,desc", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "search" ], "query": [ { "key": "page", "value": "1" }, { "key": "size", "value": "50" }, { "key": "indexPattern", "value": "v1-7-22-alert-*" }, { "key": "sort", "value": "@timestamp,desc" }, { "key": "top", "value": "10000", "description": "Maximum total results to consider" } ] }, "description": "Get only open alerts from the last 24 hours" }, "response": [] }, { "name": "List High Severity Alerts", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "[\n {\n \"field\": \"severity\",\n \"operator\": \"IS_GREATER_THAN\",\n \"value\": \"2\"\n },\n {\n \"field\": \"status\",\n \"operator\": \"IS_ONE_OF\",\n \"value\": [\n \"2\",\n \"3\"\n ]\n }\n]", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/search?page=1&size=25&top=10000&indexPattern=v1-7-22-alert-*&sort=severity,desc", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "search" ], "query": [ { "key": "page", "value": "1" }, { "key": "size", "value": "25" }, { "key": "indexPattern", "value": "v1-7-22-alert-*" }, { "key": "sort", "value": "severity,desc" }, { "key": "top", "value": "10000", "description": "Maximum total results to consider" } ] }, "description": "Get high severity alerts (severity >= 3) that are open or in review" }, "response": [] } ] }, { "name": "Alert Status Management", "item": [ { "name": "Update Alert Status - Mark as In Review", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response body is empty', function () {", " pm.expect(pm.response.text()).to.be.empty;", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"status\": 3,\n \"statusObservation\": \"Alert escalated to security team for detailed analysis\",\n \"addFalsePositiveTag\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "status" ] }, "description": "Update alert status to In Review (3) with observation note" }, "response": [] }, { "name": "Update Alert Status - Mark as Completed", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"status\": 5,\n \"statusObservation\": \"Investigation completed. Alert resolved as legitimate activity.\",\n \"addFalsePositiveTag\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "status" ] }, "description": "Mark alert as completed (5) with resolution notes" }, "response": [] }, { "name": "Mark as False Positive", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"status\": 5,\n \"statusObservation\": \"Confirmed as false positive after thorough investigation\",\n \"addFalsePositiveTag\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "status" ] }, "description": "Mark alert as false positive with automatic tag addition" }, "response": [] }, { "name": "Bulk Status Update", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\n \"c1c4e32c-dd9f-4a15-98c4-0dac2af40740\",\n \"d2f5e12a-b5a4-4bcd-91d0-2a8f5b6d9e1f\",\n \"7a12c4f3-894c-4e2a-9f1b-c7c7a0b84522\"\n ],\n \"status\": 5,\n \"statusObservation\": \"Bulk closure after weekly review\",\n \"addFalsePositiveTag\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "status" ] }, "description": "Update status for multiple alerts in a single request" }, "response": [] } ] }, { "name": "Alert Tags Management", "item": [ { "name": "Add Investigation Tags", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response body is empty', function () {", " pm.expect(pm.response.text()).to.be.empty;", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"tags\": [\"Under Investigation\", \"Priority High\", \"Escalated\"],\n \"createRule\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/tags", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "tags" ] }, "description": "Add investigation-related tags to an alert" }, "response": [] }, { "name": "Add False Positive Tag with Rule", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"tags\": [\"False Positive\", \"Reviewed\"],\n \"createRule\": true\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/tags", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "tags" ] }, "description": "Mark as false positive and create automatic rule for similar alerts" }, "response": [] }, { "name": "Remove All Tags", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"tags\": [],\n \"createRule\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/tags", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "tags" ] }, "description": "Remove all tags from an alert" }, "response": [] }, { "name": "Bulk Tag Assignment", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\n \"c1c4e32c-dd9f-4a15-98c4-0dac2af40740\",\n \"d2f5e12a-b5a4-4bcd-91d0-2a8f5b6d9e1f\",\n \"7a12c4f3-894c-4e2a-9f1b-c7c7a0b84522\"\n ],\n \"tags\": [\"Batch Processed\", \"Weekly Review\"],\n \"createRule\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/tags", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "tags" ] }, "description": "Assign tags to multiple alerts simultaneously" }, "response": [] } ] }, { "name": "Alert Notes Management", "item": [ { "name": "Add Investigation Notes", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response body is empty', function () {", " pm.expect(pm.response.text()).to.be.empty;", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "\"[2024-10-16 14:30:00] - Analyst: John Smith\\nINITIAL ANALYSIS: Alert triggered by multiple failed login attempts from IP 192.168.1.100.\\n\\nINVESTIGATION STEPS:\\n1. Checked source IP reputation - no known malicious activity\\n2. Reviewed user account activity logs\\n3. Contacted user to confirm legitimate activity\\n\\nFINDINGS:\\nUser confirmed password reset attempts during maintenance window. Activity is legitimate.\\n\\nRECOMMENDATION:\\nMark as false positive and whitelist maintenance window activities.\"", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/notes?alertId={{alertId}}", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "notes" ], "query": [ { "key": "alertId", "value": "{{alertId}}" } ] }, "description": "Add detailed investigation notes to an alert" }, "response": [] }, { "name": "Add Resolution Notes", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "\"[2024-10-16 16:45:00] - RESOLVED by Security Team\\n\\nROOT CAUSE:\\nScheduled vulnerability scan from authorized security tool (Nessus scanner at 10.0.0.5).\\n\\nACTIONS TAKEN:\\n1. Verified scan schedule in security calendar\\n2. Confirmed source IP belongs to authorized scanner\\n3. Updated alert correlation rules to reduce false positives\\n\\nPREVENTION:\\nImplemented whitelist for authorized scanner IPs and scheduled scan windows.\\n\\nSTATUS: CLOSED - False Positive\"", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/notes?alertId={{alertId}}", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "notes" ], "query": [ { "key": "alertId", "value": "{{alertId}}" } ] }, "description": "Add resolution and remediation notes to an alert" }, "response": [] }, { "name": "Clear Notes", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "\"\"", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/notes?alertId={{alertId}}", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "notes" ], "query": [ { "key": "alertId", "value": "{{alertId}}" } ] }, "description": "Clear/remove all notes from an alert" }, "response": [] } ] }, { "name": "Alert Analytics & Utilities", "item": [ { "name": "Count Open Alerts", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response contains count', function () {", " const count = parseInt(pm.response.text());", " pm.expect(typeof count).to.equal('number');", " console.log('Open alerts count:', count);", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/utm-alerts/count-open-alerts", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "count-open-alerts" ] }, "description": "Get the total count of open alerts in the system" }, "response": [] }, { "name": "Get Property Values with Count", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response is array with value/count objects', function () {", " const response = pm.response.json();", " pm.expect(response).to.be.an('object');", " if (response.length > 0) {", " const keys = Object.keys(response); pm.expect(keys.length).to.be.greaterThan(0);", " pm.expect(typeof response[keys[0]]).to.equal('number');", " }", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"field\": \"status\",\n \"filters\": [\n {\n \"field\": \"tags\",\n \"operator\": \"IS_NOT\",\n \"value\": \"False positive\"\n },\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-7d\",\n \"now\"\n ]\n }\n ],\n \"index\": \"v1-7-22-alert-*\",\n \"top\": 10,\n \"orderByCount\": true,\n \"sortAsc\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/property/values-with-count", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "property", "values-with-count" ] }, "description": "Get unique values for a specific field with their occurrence counts" }, "response": [] }, { "name": "Get Severity Distribution", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"field\": \"severity\",\n \"filters\": [\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-24h\",\n \"now\"\n ]\n }\n ],\n \"index\": \"v1-7-22-alert-*\",\n \"top\": 5,\n \"orderByCount\": true,\n \"sortAsc\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/property/values-with-count", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "property", "values-with-count" ] }, "description": "Get alert severity distribution for the last 24 hours" }, "response": [] }, { "name": "Get Top Data Sources", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"field\": \"dataSource.keyword\",\n \"filters\": [\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-7d\",\n \"now\"\n ]\n },\n {\n \"field\": \"status\",\n \"operator\": \"IS_NOT\",\n \"value\": \"5\"\n }\n ],\n \"index\": \"v1-7-22-alert-*\",\n \"top\": 15,\n \"orderByCount\": true,\n \"sortAsc\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/property/values-with-count", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "property", "values-with-count" ] }, "description": "Get top alert sources for the last week (excluding completed alerts)" }, "response": [] }, { "name": "Export Alerts to CSV", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Response is CSV format', function () {", " pm.expect(pm.response.headers.get('Content-Type')).to.include('text/csv');", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "[\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-7d\",\n \"now\"\n ]\n },\n {\n \"field\": \"severity\",\n \"operator\": \"IS_GREATER_THAN\",\n \"value\": \"2\"\n }\n]", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/search/csv?page=0&size=5000&top=10000&indexPattern=v1-7-22-alert-*&sort=@timestamp,desc", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "search", "csv" ], "query": [ { "key": "page", "value": "0" }, { "key": "size", "value": "5000" }, { "key": "top", "value": "10000" }, { "key": "indexPattern", "value": "v1-7-22-alert-*" }, { "key": "sort", "value": "@timestamp,desc" } ] }, "description": "Export filtered alerts to CSV format for external analysis" }, "response": [] }, { "name": "Export High Severity Alerts (Compliance)", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "[\n {\n \"field\": \"@timestamp\",\n \"operator\": \"IS_BETWEEN\",\n \"value\": [\n \"now-7d\",\n \"now\"\n ]\n },\n {\n \"field\": \"severity\",\n \"operator\": \"IS_GREATER_THAN\",\n \"value\": \"2\"\n }\n]", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/elasticsearch/search/csv?page=0&size=5000&top=10000&indexPattern=v1-7-22-alert-*&sort=@timestamp,desc", "host": [ "{{baseUrl}}" ], "path": [ "api", "elasticsearch", "search", "csv" ], "query": [ { "key": "page", "value": "0" }, { "key": "size", "value": "5000" }, { "key": "top", "value": "10000" }, { "key": "indexPattern", "value": "v1-7-22-alert-*" }, { "key": "sort", "value": "@timestamp,desc" } ] }, "description": "Export high severity alerts for monthly compliance reporting" }, "response": [] } ] }, { "name": "Incident Management", "item": [ { "name": "Convert Alerts to Incident", "event": [ { "listen": "test", "script": { "exec": [ "pm.test('Status code is 200', function () {", " pm.response.to.have.status(200);", "});", "", "pm.test('Incident created successfully', function () {", " // Add specific tests based on actual response structure", " console.log('Incident created from alerts');", "});" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"eventIds\": [\n \"{{alertId}}\"\n ],\n \"incidentName\": \"Security Incident - Multiple Failed Logins\",\n \"incidentId\": 0,\n \"incidentSource\": \"Unified Security Stack Alert Investigation\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/convert-to-incident", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "convert-to-incident" ] }, "description": "Convert one or more alerts into a formal security incident for case management" }, "response": [] }, { "name": "Convert Multiple Alerts to Incident", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "key", "value": "Utm-Api-Key", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"eventIds\": [\n \"c1c4e32c-dd9f-4a15-98c4-0dac2af40740\",\n \"d2f5e12a-b5a4-4bcd-91d0-2a8f5b6d9e1f\",\n \"7a12c4f3-894c-4e2a-9f1b-c7c7a0b84522\"\n ],\n \"incidentName\": \"Coordinated Attack Campaign\",\n \"incidentId\": 0,\n \"incidentSource\": \"Unified Security Stack Correlation Analysis\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/convert-to-incident", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "convert-to-incident" ] }, "description": "Create incident from multiple related alerts for comprehensive investigation" }, "response": [] } ] }, { "name": "Alert Workflows", "item": [ { "name": "Complete Investigation Workflow", "event": [ { "listen": "prerequest", "script": { "exec": [ "// This is a workflow example that combines multiple API calls", "console.log('Starting complete investigation workflow...');" ], "type": "text/javascript", "packages": {}, "requests": {} } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"alertIds\": [\"{{alertId}}\"],\n \"status\": 3,\n \"statusObservation\": \"Starting investigation - escalated to security team\",\n \"addFalsePositiveTag\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/api/utm-alerts/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "utm-alerts", "status" ] }, "description": "Step 1: Mark alert as In Review to start investigation workflow" }, "response": [] } ] } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "// Auto-set bearer token from environment or previous requests", "if (!pm.collectionVariables.get('bearerToken') && pm.environment.get('bearerToken')) {", " pm.collectionVariables.set('bearerToken', pm.environment.get('bearerToken'));", "}" ] } } ], "variable": [ { "key": "baseUrl", "value": "https://your-synoti-instance.com", "type": "string", "description": "Base URL of your Unified Security Stack instance" }, { "key": "bearerToken", "value": "", "type": "string", "description": "JWT Bearer token obtained from authentication" }, { "key": "alertId", "value": "c1c4e32c-dd9f-4a15-98c4-0dac2af40740", "type": "string", "description": "Alert UUID - populated automatically by List Alerts request" }, { "key": "apiKey", "value": "", "type": "string", "description": "Your Unified Security Stack API key (set in Utm-Api-Key header)" } ] }