Findings API

Konsoldagi alert API’da finding deb ataladi. O’qish uchun VIEWER roli va read scope kerak; biror narsani o’zgartirish uchun ANALYST va write. API kalitlar va rollar sahifasiga qarang.

Finding’lar ro’yxati

curl "https://soc.example.com/api/findings?severity=critical&status=open&include_detail=false" \
  -H "X-API-Key: legit_…"

Parametr	Ma’nosi
limit	1–1 000, sukut bo’yicha 200
severity	info, low, medium, high yoki critical
status	Masalan open, confirmed, escalated
q	Matnli qidiruv
source_type	Hodisa qayerdan kelgani, masalan windows_event yoki ssh_monitor
team	Identity & Access, Endpoint & Malware, Network & C2, Intrusion Response, General SOC
assigned_to	me, unassigned yoki foydalanuvchi nomi
sla_breached	Saralash muddati o’tgan alertlar uchun true
include_detail	false dalillar, AI fikr yuritish izi va vaqt chizig’ini chiqarib tashlaydi. Ro’yxatlar taxminan ikki baravar kichrayadi.

Javob: {"items": [...], "total": n}.

Finding nimalarni saqlaydi

Maydon	Ma’nosi
id, title, summary	Identifikator va tavsif
severity, risk_score, confidence_score	Daraja va 0 dan 100 gacha ikki ball
status	Saralashda qayerda turgani
rule_key	Uni ko’targan qoida, agar shunday bo’lsa
asset_hostname, affected_assets	Mashina va ishtirok etgan har bir obyekt
mitre_attack	ATT&CK texnika ID’lari, masalan T1110.001
occurrence_count, last_seen_at	Bir xil signal necha marta takrorlangani va oxirgisi qachon
assigned_to	Kimga biriktirilgani
evidence, timeline	Ortidagi hodisalar va qoida mosliklari, hamda shundan beri u bilan nima bo’lgani
recommended_actions, ai_summary	Keyin nima qilish kerak va tahlilchi tushuntirishi

Holatni o’zgartirish

curl -X PATCH https://soc.example.com/api/findings/<id>/status \
  -H "X-API-Key: legit_…" -H "Content-Type: application/json" \
  -d '{"status": "dismissed", "reason": "Quarterly scan by the IT team", "fp_reason_category": "approved_scan"}'

Konsoldagi o’tishlarning o’zi amal qiladi (Holatlar bo’limiga qarang).

Javob	Sababi
200	O’zgardi; yangilangan finding qaytariladi
400	reasonsiz rad etish
404	Tenantingizda bunday finding yo’q
422	O’tishga ruxsat yo’q (masalan, resolved dan chiqish) yoki noma’lum status yoki fp_reason_category

fp_reason_category — known_tool, approved_scan, test_activity, wrong_rule_logic, other dan biri. Escalate qilish finding uchun, agar u hali hech bir tekshiruvga bog’lanmagan bo’lsa, tekshiruv ochadi.

Finding’ni biriktirish uchun /api/findings/<id>/triage ga {"action": "assign", "assigned_to": "alice"} yuboring.

Boshqa endpointlar

Metod va yo’l	Nima qiladi
GET /api/findings/{id}	Bitta finding, to’liq
GET /api/findings/{id}/evidence	Uning dalillari
GET /api/findings/{id}/timeline	U bilan nima bo’lgani, tartib bilan
GET /api/findings/{id}/audit	Har bir holat o’zgarishi: kim, qayerdan, qayerga, nima uchun
GET, POST /api/findings/{id}/notes	Eslatmalarni o’qish yoki qo’shish: {"note": "…"}
POST /api/findings/{id}/investigate	Undan tekshiruv ochish
GET /api/findings/stats	Jami: ochiq, tasdiqlangan, rad etilgan va daraja bo’yicha
GET /api/findings/sla-summary	Muddatlar: buzilgan, xavf ostida, me’yorda; javobning o’rtacha vaqti
GET /api/findings/export/csv, /export/xlsx	Finding’lar jadvali
GET /api/findings/rule-metrics/{rule_key}	Qoidaning ishga tushishlari, soxta signallari va soxta signal ulushi

Eslatma

Har bir holat o’zgarishi, eslatma va biriktirish uni bajargan kalit yoki foydalanuvchi bilan audit logga yoziladi. API kalit u yerda api-key:<id> ko’rinishida chiqadi.