Return Value

The three methods that fetch events from the AWS S3 buckets, return an array of events each call until all events have been returned. Each event will be a JSON object containing the specific event’s information. Below is a sample response.

response = [{
    'timestamp': '2022-10-16T21:59:53.998000Z', 
    'uuid': '24fd131ec-85c9-4af0-b810-c541d2eff5a1', 
    'event_type': 'observation', 
    'customer_id': 'cid', 
    'sensor_id': 'sid', 
    'source': 'Fortinet', 
    'evidence_start_timestamp': '2022-10-16T21:59:53.998000Z', 
    'evidence_end_timestamp': '2022-10-16T22:59:54.814000Z', 
    'observation_uuid': 'bf1e1203-ed35-4f22-865d-89e75a1c174a', 
    'title': 'TCP Device Enumeration', 
    'category': 'relationship', 
    'confidence': 'high', 
    'src_ip': '1.2.3.4', 
    'src_ip_enrichments': {
      'internal': True, 
      'geo': {'location': {
        'lat': 37.3541069, 
        'lon': -121.955238
      },
      'country': None, 
      'subdivision': None, 
      'city': None},
      'asn': None, 
      'annotations': None
    },
    'dst_ip': None, 
    'dst_ip_enrichments': None, 
    'geo_distance': None, 
    'sensor_ids': ['chf1'], 
    'evidence_iql': 'flow:ip = 1.2.3.4 AND proto = "tcp" AND customer_id = '
      '"cid" AND timestamp >= t"2022-10-16T21:59:53.998Z" AND '
      'timestamp <= t"2022-10-16T22:59:54.814Z"', 
    'context': '{"Lowest '
      'ports":["0","1","2","3","4","5","7","9","11","13","15","17","18","19",
      "20","21","23","24","25","27","29","31","33","35","37","38"],"Count '
      'of distinct hosts":16646,"Duration (seconds) of '
      'activity":"3600.816","Average duration (seconds) between '
      'connections":"0.005"}', 
    'intel': None, 
    'class': 'specific'
}]

The next section provides more details, instructions and recommendations regarding how to build and use the client library to retrieve each event type in order to import them.