Skip to main content
McAfee Enterprise MVISION Cloud

Filter the Data from the Data Retrieval API

You can filter the results from the Data Retrieval API in order to locate specific information or reduce unnecessary content. You can include the following filter parameters to control the data that is returned in the CSV export.

Filter Parameters

  • cspId: Unique identifier for a service; accessible from the queryCloudServiceProvider endpoint.
  • userFilter or eventFilters: Pass additional parameters to limit search results.
  • deviceTypeId: A number used to identify the device used for accessing a service. See below for a mapping of Device type IDs.
  • from/to: The starting and ending point of a date range in the UTC format time, for example, “2014-09-27T00:00:00."
  • permissionsIdentifers: Flags a service as allowed or denied. 0 for allowed, 1 for denied.
  • serviceIdentifiers: Unique ID for a specific service or services. To get a list of service IDs from the queryCloudServiceProvider end point.
  • tagIdentifiers: Unique ID for tags configured in your deployment. You can pass an array of values.
  • tenantID: Unique identifier for your deployment. Will always be “1.”
  • templateID: An identifying number that should always be set as “10.”
  • userId: Unique identifier for a user, accessible from the queryUniqueUsers endpoint. You can look up the user identifiers IDs with the queryDectecedUsers rest endpoint.
  • userIdentifiers: If you want to filter by watch list you pass it as.
  • anomlyIdentifiers and subtypes: Unique IDs for the various supported anomalies and associated subtypes; you can use queryAnomalyTypeMap.
  • userOrIP: User type filter; pass 1 for user and 0 for IP.

Filtering by Custom Attributes

Select reporting endpoints allow filtering by Custom Attribute by specifying the Custom Attribute slot (Custom1-Custom5) as established when setting up your custom attribute in Enterprise Connector. For example, if you wanted to filter only users who are designated as “Support” in your custom attribute “Department”, where “Department” is defined in the 3rd Custom Attribute slow, you would use the following input:

{ "cspId":3254,
"userFilter":{

"customAttrDtos":[


{ "attributeColName":"custom3", "values":[ "Support" ] }

]
  • Was this article helpful?