User information

The bulk_user_info API endpoint gathers users who are specified in the list of users. It returns the current risk score of the system and the users who matches the name or names provided (case sensitive). The user data returned has fields shown in the following sample from the UBA database.

cURL command

curl -k -H 'Content-Type:application/json' -H 'Accept:application/json' -H 'SEC:SEC_TOKEN' -X POST -d '{"users":["USER_NAME”, “USER2_NAME”, “USER3_NAME”]}’ https://QR_IP_ADDRESS/console/plugins/UBA_APP_ID/app_proxy/api/bulk_user_info

Sample return

{"risk_threshold":244.0,"users":[{"alert":null,"alias_properties":[{"alias":"mike.smith","is_dormant":false,"last_seen":0}],"aliases":["mike.smith"],"city":null,"country":null,"custom_group":null,"dept":null,"display_name":"mike.smith","email":null,"full_name":null,"id":3,"id1":"mike.smith","id2":null,"id3":null,"id4":null,"in_custom_grp_peer_group_watchlist":false,"in_dept_peer_group_watchlist":false,"in_job_title_peer_group_watchlist":false,"in_ml_abridged_watch_list":true,"in_ml_watch_list":true,"in_peer_group_watchlist":false,"input_username":"mike.smith","investigation_expires":0,"investigation_started":0,"investigation_user":null,"job_title":null,"last_offense_time":1626278817,"latest_risk":105.0,"linked_import_ids":null,"manager":null,"member_of":null,"ml_id":"mike.smith","ml_watched":false,"prolonged_risk":21550.0,"risk":1642.33,"risk_1":1631.36,"risk_2":1612.69,"risk_3":1619.43,"risk_poll_count":235,"risk_scale_max":1.0,"source":"ariel","state":null,"trending":1,"trusted_user":false,"updated_this_run":0,"username":"mike.smith","watched":1,"watchlist_memberships":[{"addition_date":1626267571,"from_ref_set":false,"from_regex":true,"name":"Watch ML Users with data","ref_set":null,"regex":"ibm_sense","regex_field":"username","risk_scale":1.0,"source":"automatic","watchlist_id":2}],"watson_search_date":0,"watson_search_id":null}]}