Benutzerinformationen

Der API-Endpunkt bulk_user_info erfasst Benutzer, die in der Liste der Benutzer angegeben sind. Er gibt die aktuelle Risikobewertung des Systems sowie die Benutzer zurück, die mit dem/den angegebenen Namen übereinstimmen (Groß-/Kleinschreibung muss beachtet werden). Die zurückgegebenen Benutzerdaten umfassen Felder, die in dem folgenden Beispiel aus der UBA-Datenbank dargestellt sind.

cURL-Befehl

curl -k -H 'Content-Type:application/json' -H 'Accept:application/json' -H 'SEC:SEC_TOKEN' -X POST -d '{"users":["USER_NAME”, “USER2_NAME”, “USER3_NAME”]}’ https://QR_IP_ADDRESS/console/plugins/UBA_APP_ID/app_proxy/api/bulk_user_info

Beispielrückgabe

{"risk_threshold":244.0,"users":[{"alert":null,"alias_properties":[{"alias":"mike.smith","is_dormant":false,"last_seen":0}],"aliases":["mike.smith"],"city":null,"country":null,"custom_group":null,"dept":null,"display_name":"mike.smith","email":null,"full_name":null,"id":3,"id1":"mike.smith","id2":null,"id3":null,"id4":null,"in_custom_grp_peer_group_watchlist":false,"in_dept_peer_group_watchlist":false,"in_job_title_peer_group_watchlist":false,"in_ml_abridged_watch_list":true,"in_ml_watch_list":true,"in_peer_group_watchlist":false,"input_username":"mike.smith","investigation_expires":0,"investigation_started":0,"investigation_user":null,"job_title":null,"last_offense_time":1626278817,"latest_risk":105.0,"linked_import_ids":null,"manager":null,"member_of":null,"ml_id":"mike.smith","ml_watched":false,"prolonged_risk":21550.0,"risk":1642.33,"risk_1":1631.36,"risk_2":1612.69,"risk_3":1619.43,"risk_poll_count":235,"risk_scale_max":1.0,"source":"ariel","state":null,"trending":1,"trusted_user":false,"updated_this_run":0,"username":"mike.smith","watched":1,"watchlist_memberships":[{"addition_date":1626267571,"from_ref_set":false,"from_regex":true,"name":"Watch ML Users with data","ref_set":null,"regex":"ibm_sense","regex_field":"username","risk_scale":1.0,"source":"automatic","watchlist_id":2}],"watson_search_date":0,"watson_search_id":null}]}