Remediation API

All API URLs should be prefixed with
https://<your-server-ip>:8443/openapi/api/rest/v1/remediation

• Remediation API
  • Preface
  • Authentication
    • Basic Authentication
  • Objects used with these APIs
    • RemediationResponse
  • Suspend a User
  • Unsuspend a User

Preface

The following post detail how to execute remediation actions inside the SkyFormation cloud apps connector accounts using APIs.

Authentication

Only users assigned the remediation-admin role are authorized to use this API.
See guide

Objects used with these APIs

RemediationResponse

{
    "is-success": boolean,
    "status-message": string optional,
}

Suspend a User

Supported connectors:

• Salesforce
• DropBox
  • Requires an additional members access token with "team member management" permission
• ServiceNow
• Azure
  • Requires permission "Microsoft Graph" -> "Read and write all users' full profiles"
• Office365
  • Requires permission "Microsoft Graph" -> "Read and write all users' full profiles"

POST /{account-id}/suspend-user

Query Parameters:

• userAttributeName - a required string with the user attribute name used to identify the user (should be taken from the suid field in SkyFormation CEF events)
• userAttributeValue - a required string with the user attribute value used to identify the user 
  (should be taken from the suser field in SkyFormation CEF events)

Response:
200,
RemediationResponse

Unsuspend a User

Supported connectors:

• Salesforce
• DropBox
  • Requires an additional members access token with "team member management" permission
• ServiceNow
• Azure
  • Requires permission "Microsoft Graph" -> "Read and write all users' full profiles"
• Office365
  • Requires permission "Microsoft Graph" -> "Read and write all users' full profiles"

POST /{account-id}/un-suspend-user

Query Parameters:

• userAttributeName - a required string with the user attribute name used to identify the user (should be taken from the suid field in SkyFormation CEF events)
• userAttributeValue - a required string with the user attribute value used to identify the user 
  (should be taken from the suser field in SkyFormation CEF events)

Response:
200,
RemediationResponse