ユーザー情報

bulk_user_info API エンドポイントは、ユーザーのリストで指定されたユーザーを収集します。 また、システムの現在のリスク・スコアと、指定された名前 (複数可、大/小文字の区別あり) に一致するユーザーを返します。 返されるユーザー・データには、以下のサンプルに示されている、UBA データベースからのフィールドがあります。

cURL コマンド

curl -k -H 'Content-Type:application/json' -H 'Accept:application/json' -H 'SEC:SEC_TOKEN' -X POST -d '{"users":["USER_NAME”, “USER2_NAME”, “USER3_NAME”]}’ https://QR_IP_ADDRESS/console/plugins/UBA_APP_ID/app_proxy/api/bulk_user_info

戻りの例

{"risk_threshold":244.0,"users":[{"alert":null,"alias_properties":[{"alias":"mike.smith","is_dormant":false,"last_seen":0}],"aliases":["mike.smith"],"city":null,"country":null,"custom_group":null,"dept":null,"display_name":"mike.smith","email":null,"full_name":null,"id":3,"id1":"mike.smith","id2":null,"id3":null,"id4":null,"in_custom_grp_peer_group_watchlist":false,"in_dept_peer_group_watchlist":false,"in_job_title_peer_group_watchlist":false,"in_ml_abridged_watch_list":true,"in_ml_watch_list":true,"in_peer_group_watchlist":false,"input_username":"mike.smith","investigation_expires":0,"investigation_started":0,"investigation_user":null,"job_title":null,"last_offense_time":1626278817,"latest_risk":105.0,"linked_import_ids":null,"manager":null,"member_of":null,"ml_id":"mike.smith","ml_watched":false,"prolonged_risk":21550.0,"risk":1642.33,"risk_1":1631.36,"risk_2":1612.69,"risk_3":1619.43,"risk_poll_count":235,"risk_scale_max":1.0,"source":"ariel","state":null,"trending":1,"trusted_user":false,"updated_this_run":0,"username":"mike.smith","watched":1,"watchlist_memberships":[{"addition_date":1626267571,"from_ref_set":false,"from_regex":true,"name":"Watch ML Users with data","ref_set":null,"regex":"ibm_sense","regex_field":"username","risk_scale":1.0,"source":"automatic","watchlist_id":2}],"watson_search_date":0,"watson_search_id":null}]}