Skip to main content

sendTestPushEvent

This method sends a test event.

Test events always have the _testEvent_ property set to true.

Parameters

Parameter

Type

Optional

Description

eventType

String

No

The type of event you want to send a test for.

Possible values:

  • hwid-change - Hardware ID Change. This event is generated when the hardware ID of an endpoint from your network is changed.

  • adcloud - Cloud AD Integration. This event is generated when Control Center is synchronizing with an Active Directory domain.

  • aph - Antiphishing. This notification informs you each time the endpoint agent detects a known phishing attempt when accessing a web page.

  • av - Antimalware. Denotes Antimalware events triggered upon malware detection on an endpoint.

  • avc - Advanced Threat Control (ATC). This event is created whenever a potentially dangerous application is detected and blocked on an endpoint.

  • dp - Data Protection. This event is generated each time the data traffic is blocked on an endpoint, according to data protection rules.

  • exchange-malware - Exchange Malware Detection. This event is created when Bitdefender detects malware on an Exchange server in your network.

  • exchange-user-credentials - Exchange User Credentials. This event is generated when an on-demand scan task could not start on the target Exchange server due to invalid user credentials. To complete the task, you need to change your Exchange credentials.

  • fw - Firewall. This event is generated when the endpoint agent blocks a port scan or an application from accessing the network, according to the applied policy.

  • hd - Hyper Detect event. Event generated when malware is detected by the Hyper Detect module.

  • modules - Product Modules Status. This event is generated when a security module of the installed agent gets enabled or disabled.

  • network-sandboxing - Sandbox Analyzer Detection. This event is generated each time Sandbox Analyzer detects a new threat among the submitted files.

  • registration - Product Registration. This event is generated when the registration status of an agent installed in your network has changed.

  • supa-update-status - Outdated Update Server. This event is generated when an update server has outdated malware signatures.

  • sva-load - Overloaded Security Server. This event is generated when the scan load on a Security Server in your network exceeds the defined threshold.

  • sva - Security Server Status. This event is created when the status of a certain Security Server changes. The status refers to power (powered on/powered off), product update, signatures update and reboot required.

  • task-status - Task Status. This event is generated each time a task status changes.

  • uc - User Control/Content Control. This event is generated when a user activity such as web browsing of software application is blocked on the endpoint according to the applied policy.

  • antiexploit - Antiexploit Event. This event is generated when Advanced Anti-Exploit triggers a detection.

  • endpoint-moved-out - Endpoint moved out. This event is generated when endpoints are moved in Network Inventory from one company to another. The event is received by the source company.

  • endpoint-moved-in - Endpoint moved in. This event is generated when endpoints are moved in Network Inventory from one company to another. The event is received by the destination company.

  • troubleshooting-activity - Troubleshooting activity. The event is generated when a troubleshooting task ends, and it informs you of its status. If successful, it provides you with the logs.

  • uninstall - Uninstall Agent. This event is generated when an agent is uninstalled from an endpoint.

  • install - Install Agent. This event is generated when the agent is installed on endpoints.

  • network-monitor - Network Attack Defense Event. This event is generated when the Network Attack Defense module triggers a detection.

  • ransomware-mitigation - Ransomware activity detection. This event occurs when the endpoint agent blocks a ransomware attack.

  • security-container-update-available - Security container update available. This event is generated when a new update is detected for a security container.

  • partner-changed - Partner change. This event is generated every time a client company has joined or left your management.

  • device-control - Device Control. Every time the Device Control module detects a device inserted into a client system, an event is generated.

  • new-incident - New Incident. This event is generated every time a new Root Cause Analysis (RCA) is displayed under the Incidents section of Control Center. The event contains a list of relevant items extracted from the RCA JSON, which you can use to enrich SIEM-driven correlations with EDR-specific data.

  • incident-status-changed - Incident status changed: This event is sent whenever an incident status changes.

  • incident-assignee-changed - Incident assignee changed: This event is sent whenever an incident assignee changes.

  • incident-priority-changed - Incident priority changed: This event is triggered whenever an incident priority changes.

  • incident-note-created - Incident note created: This event is triggered whenever a note is added to an incident.

  • incident-note-updated - Incident note updated: This event is sent when an incident note is updated.

  • incident-note-deleted - Incident note deleted: This event is triggered when an incident note is deleted.

data

Object

Yes

Test events are created from templates. This parameter can be used to overwrite data in the returned event example.

General parameters

Parameter

Description

Included in request

Type

Values

id

This parameter adds an identifier to the request, linking it to its corresponding response.

The target replies with the same value in the response, allowing easy call tracking.

Mandatory

String

No additional requirements

method

The name of the method you are using to send the request.

Mandatory

String

Possible values:

  • sendTestPushEvent

jsonrpc

The version of JSON-RPC used by the request and the response.

Mandatory

Integer

Possible values:

  • 2.0

params

An object containing the configuration of the request.

Mandatory

Object

No additional requirements.

Return value

This method returns an Object containing the details of the sent event and a Boolean that marks the event as a test.

Example

Request

Send a test push event, overwriting the malware_name attribute with the Test malware name value.

  {
       "params": {
           "eventType": "av",
           "data": {
               "malware_name": "Test malware name"
           }
       },
       "jsonrpc": "2.0",
       "method": "sendTestPushEvent",
       "id": "ad12cb61-52b3-4209-a87a-93a8530d91cb"
  }

Send a test push event without overwriting any attributes.

  {
       "params": {
           "eventType": "av",
       },
       "jsonrpc": "2.0",
       "method": "sendTestPushEvent",
       "id": "ad12cb61-52b3-4209-a87a-93a8530d91cb"
  }

Responses

In this section: