Detailed vulnerability-computer mapping with filter and pagination

This API returns each vulnerability information in relation to a computer in a detailed format. In other words, every JSON object of the data array will have a computer information and vulnerability information together.
Note: This API is used to fetch large amount of data. This API is supported on Endpoint Central (for both OP and Cloud) and Vulnerability Manager Plus build versions 11.3.2430.01 and above. It is not supported for Endpoint Central MSP.

Endpoints

get /dcapi/threats/detailedinfo/vulnerabilities

Copy full URL

Request URL

https://{serverurl}/dcapi/threats/detailedinfo/vulnerabilities

Scope

DesktopCentralCloud.VulnerabilityMgmt.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Query Parameters

pagestringOptional

Displays the content of the provided page number.

customernamestringOptional

customeridlongOptional

pageLimitstringOptional

5000 (Default)

- Request Body

application/json

JSON Object

Hide Sub-Attributes

updatedTimestringOptional

If you need to get data greater than updatedTime, then provide updated time in milli second format.

vulnerabilityStatusstringOptional

cursorstringOptional

In second hit we need to add cursor got from the first api hit in the request body to get next set of data.

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url https://appdomains/dcapi/threats/detailedinfo/vulnerabilities \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: application/json' \
  --data '{}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/dcapi/threats/detailedinfo/vulnerabilities"))
        .header("content-type", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.ofString("{}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

payload = "{}"

headers = {
    'content-type': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/dcapi/threats/detailedinfo/vulnerabilities", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Content-Type", "application/json");
    headersMap.put("Accept", "application/json");

    data=Map();

    response = invokeUrl
    [
        url: "https://appDomains/dcapi/threats/detailedinfo/vulnerabilities"
        type: GET
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("content-type", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/dcapi/threats/detailedinfo/vulnerabilities' -Method GET -Headers $headers -ContentType 'application/json' -Body '{}'

Sample Request Body

The request body is not required for the first hit, but it will be needed for the second and subsequent hits

Copied!

  {
    "cursor": "cmVzb3VyY2VfaWQ9NjAxO3Z1bG5lcmFiaWxpdHlpZD0yOTk1MDc7"
  }

▼ Show full

If you need to get data greater than updatedTime, then modify the request body as,

Copied!

  {
    "cursor": "cmVzb3VyY2VfaWQ9NjAxO3Z1bG5lcmFiaWxpdHlpZD0yOTk1MDc7",
    "updatedTime": "12345678910"
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

Possible Response Codes

200HTTP code

Sample Response: HTTP 200

Step 1:
First hit:/dcapi/threats/detailedinfo/vulnerabilities
Sample Request Body: No request body in the first hit.
Since in the below response, 'isNextPageAvailable' is 'true', we have to hit the same API with 'cursor' in the payload. -> In every API Hit you'll receive 'cursor' and 'isNextPageAvailable' values.
If 'isNextPageAvailable' is 'true' in an API response, then we hit the API again with 'cursor' value in payload until, 'isNextPageAvailable' value is 'false'

Copied!

  {
    "metadata": {
      "cursor": "cmVzb3VyY2VfaWQ9NjAxO3Z1bG5lcmFiaWxpdHlpZD0yOTk1MDc7",
      "pageLimit": 1,
      "totalRecords": 1,
      "isNextPageAvailable": true
    },
    "message_response": {
      "data": [
        {
          "severity": "Critical",
          "cvss_2_score": "--",
          "patch_description": "Security Update for SQL Server 2022 RTM (KB5046861)",
          "reference_links": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21528,https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21529",
          "exploitscount": 0,
          "ip_address": "172.23.192.1,172.19.176.1,172.21.239.42",
          "vulnerability_status": "open",
          "fqdn_name": "PURRY-031.DOMAIN.COM",
          "updatedtime": 1733906647275,
          "patchid": 40226,
          "vulnerabilityid": 174340,
          "vulnerabilityname": "Microsoft SQL Server Remote Code Execution Vulnerability for SQL Server 2022 RTM GDR (KB5021522)",
          "cveids": "CVE-2023-21528,CVE-2023-21568,CVE-2023-21704,CVE-2023-21705,CVE-2023-21713,CVE-2023-21718,CVE-2023-23384",
          "resource_id": 301,
          "resource_name": "PURRY-031",
          "cvss_3_score": 9.8
        }
      ]
    }
  }

▼ Show full

Step:2
Second API hit:/dcapi/threats/detailedinfo/vulnerabilities
Sample Request Body: In second hit we need to add cursor in the request body to get next set of data. Refer the request body from the request body field for payload of second hit. If 'isNextPageAvailable' is 'false', there's no need to call the API again, as it indicates there is no more data available

Copied!

  {
    "metadata": {
      "cursor": "cmVzb3VyY2VfaWQ9NjAxO3Z1bG5lcmFiaWxpdHlpZD0yOTk1MDc7",
      "pageLimit": 1,
      "totalRecords": 1,
      "isNextPageAvailable": false
    },
    "message_response": {
      "data": [
        {
          "severity": "Important",
          "cvss_2_score": "--",
          "patch_description": "Security Update for SQL Server 2022 RTM CU (KB5046862)",
          "reference_links": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-29349",
          "exploitscount": 0,
          "ip_address": "172.23.192.1,172.19.176.1,172.21.239.42",
          "vulnerability_status": "open",
          "fqdn_name": "PURRY-031.DOMAIN.COM",
          "updatedtime": 1733906647275,
          "patchid": 40226,
          "vulnerabilityid": 181871,
          "vulnerabilityname": "Microsoft ODBC and OLE DB Remote Code Execution Vulnerability for SQL Server 2022 - KB5026806",
          "cveids": "CVE-2023-29349,CVE-2023-29356,CVE-2023-32025,CVE-2023-32026,CVE-2023-32027,CVE-2023-32028,CVE-2023-38169",
          "resource_id": 301,
          "resource_name": "PURRY-031",
          "cvss_3_score": 7.7
        }
      ]
    }
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.