topic About Cisco Threatgrid API in Endpoint Security

About Cisco Threatgrid API

betuluy — Tue, 13 Aug 2024 06:54:03 GMT

Hi team,

I want to connect to Cisco Threatgrid API and then pull the user list and delete specific users. I want to pull the user list because I need the user IDs to delete these users. But I couldn't find the appropriate endpoint. There are different URLs in the UI and in the documents on the internet, can you give me information about which one is correct and the current API document

Thanks,

Re: About Cisco Threatgrid API

Matthew Franks — Tue, 13 Aug 2024 11:32:50 GMT

To pull all the users from the Threatgrid API, you can use the /organizations/:org-id/users API call found here. It would look like this:
curl -i -XGET 'https://panacea.threatgrid.com/api/v3/organizations/<ORG_ID>/users' -H 'Content-Type: application/json' -H 'Authorization: bearer <API_KEY>'

Be sure to replace <ORG_ID> and <API_KEY> with your actual values. You can find your ORG_ID by going to Administration > Organization and looking at the URL. The ORG_ID will be a 5 digit number at the end.

Hope that helps,

-Matt

Re: About Cisco Threatgrid API

betuluy — Tue, 13 Aug 2024 12:39:02 GMT

Hi Matt,

Thank you for quick response.
I logged in my UI. But, I can't see "Organization" tab. Also, my role is admin. When I click to the "Manage Organization" field. I saw my URL like https://x.x.x.x/organizations/1 (not 5 digit number at the end)

Also, I didn't see https://panacea.threatgrid.com/mask/api-doc/api/v3/organizations/:org-id/users?region=US this page. Because, I dont have account.

Thanks for your help,

Good days

Re: About Cisco Threatgrid API

Matthew Franks — Tue, 13 Aug 2024 12:43:32 GMT

Without additional information on your account, I can't really help further. If you open a TAC case, they can help you gather the information you would need to make the API call.

Thanks,

-Matt

Re: About Cisco Threatgrid API

bmahsan — Wed, 14 Aug 2024 23:58:08 GMT

It looks like you have a SMA (Threat Grid) appliance.

For appliance it will not be a 5 digit number. for appliance you can try this -

curl -i -XGET 'https://<IP or hostname of Clean Interface>/api/v3/organizations/<ORG_ID>/users' -H 'Content-Type: application/json' -H 'Authorization: bearer <API_KEY>'

Org_ID you can find it in the URL as you have already found it `1`, you can use your Admin API Key

In appliance you can access the API reference doc from Help, there should be a ? icon on upper left corner.
or you can access it from https://<IP or hostname of Clean Interface>/mask/doc/mask/help-api-overview