Get Process Inspection Memory Script Events

Retrieves the list of in-memory script execution events

This API will return a list of in-memory script execution events generated by a process that was inspected by the Malware Prevention Service (MPS). For a given set of filters, a maximum of 10,000 unique processes will be returned. The supported values for the optional parameter 'sort_by' are:

INSPECTION_TIME (Default)
THREAT_SCORE

Request

URI

GET

https://{api_host}/malware-prevention/inspected-processes/memory-script-events

COPY

Query Parameters

integer

start_time

Required

Use this request param for specifying starting time of a timeline. Value has to be specified in milliseconds since epoch.

integer

end_time

Required

Use this request param for specifying ending time of a timeline. Value has to be specified in milliseconds since epoch.

string

sort_by

Optional

The parameter name on which to sort the list of records. Only top-level parameters in the returned list of records will be supported. If not provided, system will define the parameter by which results are sorted.

boolean,null

sort_ascending

Optional

Constraints: default: false

True, if the list of records returned need to be sorted in ascending order, false otherwise.

integer

offset

Optional

Constraints: minimum: 0 default: 0

Offset pagination parameter used to exclude from a response the first N items of a resource collection. Combine the offset and the page_size options to request a particular set or page of items.

integer

page_size

Optional

Constraints: minimum: 0 default: 1000

Number of records to be returned in the API request from the provided offset

array,null

vm_id

Optional

ID of the Virtual Machine.

string of array

process_uuid

Required

Constraints: minItems: 1 maxItems: 100

UUID of the Process. This is a required parameter.

string of array

analyst_task_uuid

Optional

Constraints: maxItems: 100

Used for specifying Analyst Task UUID to filter. If this parameter is passed multiple times, OR condition will be assumed.

Authentication

This operation uses the following authentication methods.

Responses

200

Successful Operation

Returns ProcessInspectionEventsListResult of type(s) application/json

This response body class contains all of the following: ListResult , InlineProcessInspectionEventsListResult1

{
    "total_result_count": 2,
    "results": [
        {
            "event_type": "BUFFER_SCAN",
            "inspection_time": 1772691563082,
            "buffer": "@{GUID=\"EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D\" Author=\"Microsoft Corporation\" CompanyName=\"Microsoft Corporation\" ...}",
            "buffer_category": "POWERSHELL",
            "analyst_task_uuid": "a6efd9302a91001024a0018f756b9fba",
            "inspection_status": "COMPLETED",
            "threat_score": 0,
            "verdict": "BENIGN",
            "rule_id": "",
            "os_type": "Windows 10.0.22000 Service Pack 0.0 Product Type 1"
        },
        {
            "event_type": "BUFFER_SCAN",
            "inspection_time": 1772691559062,
            "buffer": "#requires -version 3.0 try { Microsoft.PowerShell.Core\\Set-StrictMode -Off } catch { } ...}",
            "buffer_category": "POWERSHELL",
            "analyst_task_uuid": "88add8bc6fa900102ff0abb19ecc0581",
            "inspection_status": "COMPLETED",
            "threat_score": 0,
            "verdict": "BENIGN",
            "rule_id": "",
            "os_type": "Windows 10.0.22000 Service Pack 0.0 Product Type 1"
        }
    ]
}

400

Bad request.

Returns Error of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

401

Unauthorized

Returns Unauthorized of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

403

Forbidden

Returns Forbidden of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

412

Precondition Failed

Returns PreconditionFailed of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

428

Precondition Required

Returns PreconditionRequired of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

429

Too Many Requests

Returns TooManyRequests of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

Code Samples

COPY

                    curl -H 'Authorization: <value>' https://{api_host}/malware-prevention/inspected-processes/memory-script-events?start_time=value&end_time=value&process_uuid=v

On This Page

Description

Request

Query Parameters

Authentication

Response

200 Response Body

Errors

Malware Prevention Operations

GET

Get Inspected Files

GET