Lists all detected attacks on your applications.
The request produces an application/json payload.
| GET | SaaS | https://{your-environment-id}.live.dynatrace.com/api/v2/attacks |
| Environment ActiveGateCluster ActiveGate | https://{your-activegate-domain}:9999/e/{your-environment-id}/api/v2/attacks |
To execute this request, you need an access token with attacks.read scope.
To learn how to obtain and use it, see Tokens and authentication.
The cursor for the next page of results. You can find it in the nextPageKey field of the previous response.
The first page is always returned if you don't specify the nextPageKey query parameter.
When the nextPageKey is set to obtain subsequent pages, you must omit all other query parameters.
The amount of attacks in a single response payload.
The maximal allowed page size is 500.
If not set, 100 is used.
Defines the scope of the query. Only attacks matching the specified criteria are included in the response. You can add one or more of the following criteria. Values are not case-sensitive and the EQUALS operator is used unless otherwise specified.
state("value"). The state of the attack. Possible values are EXPLOITED, BLOCKED, and ALLOWLISTED.attackType("value"). The type of the attack. Find the possible values in the description of the attackType field of the response.countryCode("value"). The country code of the attacker. Supported values include all ISO-3166-1 alpha-2 country codes (2-letter). Supplying empty filter value countryCode() will return attacks, where location is not available.requestPathContains("value"). Filters for a substring in the request path. The CONTAINS operator is used. A maximum of 48 characters are allowed.processGroupNameContains("value"). Filters for a substring in the targeted process group's name. The CONTAINS operator is used.vulnerabilityId("123456789"). The exact ID of the vulnerability.sourceIps("93.184.216.34", "63.124.6.12"). The exact IPv4/IPv6 addresses of the attacker.managementZoneIds("mzId-1", "mzId-2").managementZones("name-1", "name-2"). Values are case sensitive.technology("technology-1", "technology-2"). Find the possible values in the description of the technology field of the response. The EQUALS operator is used.To set several criteria, separate them with a comma (,). Only results matching (all criteria are included in the response.
Specify the value of a criterion as a quoted string. The following special characters must be escaped with a tilde (~) inside quotes:
~"Specifies one or more fields for sorting the attack list. Multiple fields can be concatenated using a comma (,) as a separator (e.g. +state,-timestamp).
You can sort by the following properties with a sign prefix for the sorting order.
displayId: The attack's display ID.displayName: The attack's display name.attackType: The type of the attack (e.g. SQL_INJECTION, JNDI_INJECTION, etc.).state: The state of the attack. (+ low severity state first - high severity state first)sourceIp: The IP address of the attacker. Sorts by the numerical IP value.requestPath: The request path where the attack was started.timestamp: When the attack was executed. (+ old attacks first or - new attacks first)
If no prefix is set, + is used.A list of additional attack properties you can add to the response.
The following properties are available (all other properties are always included and you can't remove them from the response):
attackTarget: The targeted host/database of an attack.request: The request that was sent from the attacker.entrypoint: The entry point used by an attacker to start a specific attack.vulnerability: The vulnerability utilized by the attack.securityProblem: The related security problem.attacker: The attacker of an attack.managementZones: The related management zones.affectedEntities: The affected entities of an attack.To add properties, specify them in a comma-separated list and prefix each property with a plus (for example, +attackTarget,+securityProblem).
The start of the requested timeframe.
You can use one of the following formats:
2021-01-25T05:57:01.123+01:00. If no time zone is specified, UTC is used. You can use a space character instead of the T. Seconds and fractions of a second are optional.now-NU/A, where N is the amount of time, U is the unit of time, and A is an alignment. The alignment rounds all the smaller values to the nearest zero in the past. For example, now-1y/w is one year back, aligned by a week.
You can also specify relative timeframe without an alignment: now-NU.
Supported time units for the relative timeframe are:
m: minutesh: hoursd: daysw: weeksM: monthsy: yearsIf not set, the relative timeframe of thirty days is used (now-30d).
The end of the requested timeframe.
You can use one of the following formats:
2021-01-25T05:57:01.123+01:00. If no time zone is specified, UTC is used. You can use a space character instead of the T. Seconds and fractions of a second are optional.now-NU/A, where N is the amount of time, U is the unit of time, and A is an alignment. The alignment rounds all the smaller values to the nearest zero in the past. For example, now-1y/w is one year back, aligned by a week.
You can also specify relative timeframe without an alignment: now-NU.
Supported time units for the relative timeframe are:
m: minutesh: hoursd: daysw: weeksM: monthsy: yearsIf not set, the current timestamp is used.
AttackList objectA list of attacks.
The cursor for the next page of results. Has the value of null on the last page.
Use it in the nextPageKey query parameter to obtain subsequent pages of the result.
The number of entries per page.
The total number of entries in the result.
Attack objectDescribes an attack.
The ID of the attack.
The type of the attack.
COMMAND_INJECTIONJNDI_INJECTIONSQL_INJECTIONSSRFThe display ID of the attack.
The display name of the attack.
Assessment information and the ID of a security problem related to an attack.
The state of the attack.
ALLOWLISTEDBLOCKEDEXPLOITEDThe technology of the attack.
DOTNETGOJAVANODE_JSThe timestamp when the attack occurred.
AffectedEntities objectInformation about affected entities of an attack.
AffectedEntity objectInformation about an affected entity.
The monitored entity ID of the affected entity.
The name of the affected entity.
AttackTarget objectInformation about the targeted host/database of an attack.
The monitored entity ID of the targeted host/database.
The name of the targeted host/database.
Attacker objectAttacker of an attack.
The source IP of the attacker.
AttackerLocation objectLocation of an attacker.
City of the attacker.
The country of the attacker.
The country code of the country of the attacker, according to the ISO 3166-1 Alpha-2 standard.
AttackEntrypoint objectDescribes the entrypoint used by an attacker to start a specific attack.
A list of values that has possibly been truncated.
CodeLocation objectInformation about a code location.
The fully qualified class name of the code location.
The column number of the code location.
A human readable string representation of the code location.
The file name of the code location.
The function/method name of the code location.
The line number of the code location.
The return type of the function.
TruncatableListString objectA list of values that has possibly been truncated.
Values of the list.
TruncationInfo objectInformation on a possible truncation.
If the list/value has been truncated.
FunctionDefinition objectInformation about a function definition.
The fully qualified class name of the class that includes the function.
A human readable string representation of the function definition.
The file name of the function definition.
The function/method name of the function definition.
The return type of the function.
EntrypointPayload objectDescribes a payload sent to an entrypoint during an attack.
Name of the payload, if applicable.
Type of the payload.
HTTP_BODYHTTP_COOKIEHTTP_HEADER_NAMEHTTP_HEADER_VALUEHTTP_OTHERHTTP_PARAMETER_NAMEHTTP_PARAMETER_VALUEHTTP_URLUNKNOWNValue of the payload.
ManagementZone objectA short representation of a management zone.
The ID of the management zone.
The name of the management zone.
RequestInformation objectDescribes the complete request information of an attack.
The target host of the request.
The request path.
The requested URL.
ProtocolDetails objectDetails that are specific to the used protocol.
HttpProtocolDetails objectHTTP specific request details.
The HTTP request method.
TruncatableListAttackRequestHeader objectA list of values that has possibly been truncated.
AttackRequestHeader objectA header element of the attack's request.
The name of the header element.
The value of the header element.
TruncatableListHttpRequestParameter objectA list of values that has possibly been truncated.
HttpRequestParameter objectAn HTTP request parameter.
The name of the parameter.
The value of the parameter.
AttackSecurityProblem objectAssessment information and the ID of a security problem related to an attack.
The assessment of a security problem related to an attack.
The security problem ID.
AttackSecurityProblemAssessmentDto objectThe assessment of a security problem related to an attack.
The reachability of data assets by the attacked target.
NOT_AVAILABLENOT_DETECTEDREACHABLEThe level of exposure of the attacked target
NOT_AVAILABLENOT_DETECTEDPUBLIC_NETWORKThe number of data assets reachable by the attacked target.
Vulnerability objectDescribes the exploited vulnerability.
The display name of the vulnerability.
The id of the vulnerability.
Describes what got passed into the code level vulnerability.
VulnerableFunctionInput objectDescribes what got passed into the code level vulnerability.
The type of the input.
COMMANDHTTP_CLIENTJNDISQL_STATEMENTVulnerableFunctionInputSegment objectDescribes one segment that was passed into a vulnerable function.
The type of the input segment.
MALICIOUS_INPUTREGULAR_INPUTTAINTED_INPUTThe value of the input segment.
{"attacks": [{"affectedEntities": {"processGroup": {"id": "string","name": "string"},"processGroupInstance": {}},"attackId": "string","attackTarget": {"entityId": "string","name": "string"},"attackType": "COMMAND_INJECTION","attacker": {"location": {"city": "string","country": "string","countryCode": "string"},"sourceIp": "string"},"displayId": "string","displayName": "string","entrypoint": {"codeLocation": {"className": "string","columnNumber": 1,"displayName": "string","fileName": "string","functionName": "string","lineNumber": 1,"parameterTypes": {"truncationInfo": {"truncated": true},"values": ["string"]},"returnType": "string"},"entrypointFunction": {"className": "string","displayName": "string","fileName": "string","functionName": "string","parameterTypes": {},"returnType": "string"},"payload": [{"truncationInfo": {},"values": [{"name": "string","type": "HTTP_BODY","value": "string"}]}]},"managementZones": [{"id": "string","name": "string"}],"request": {"host": "string","path": "string","protocolDetails": {"http": {"headers": {"truncationInfo": {},"values": [{"name": "string","value": "string"}]},"parameters": {"truncationInfo": {},"values": [{"name": "string","value": "string"}]},"requestMethod": "string"}},"url": "string"},"securityProblem": {"assessment": {"dataAssets": "NOT_AVAILABLE","exposure": "NOT_AVAILABLE","numberOfReachableDataAssets": 1},"securityProblemId": "string"},"state": "ALLOWLISTED","technology": "DOTNET","timestamp": 1,"vulnerability": {"codeLocation": {},"displayName": "string","vulnerabilityId": "string","vulnerableFunction": {},"vulnerableFunctionInput": {"inputSegments": [{"type": "MALICIOUS_INPUT","value": "string"}],"type": "COMMAND"}}}],"nextPageKey": "AQAAABQBAAAABQ==","pageSize": 1,"totalCount": 1}