How to Export Sekoia.io Events for Security Investigations
Summary
A guide to exporting Sekoia.io events through its search API, with steps for paginated retrieval, large exports, permissions and troubleshooting. It also describes reviewing logs in LogTotal.
Key points
- Create an events search job with a query and time window, wait for it to finish, then retrieve events in pages of up to 1,000.
- The Events page export is limited to 500 events; larger exports can use the massive export API or the sekoia-event-exporter package.
- Searching requires an API key with event-search permission; massive exports require SIC_MASSIVE_EXPORT_EVENTS.
- Use the API host for your region; the article gives hxxps://api[.]sekoia[.]io and hxxps://api[.]usa1[.]sekoia[.]io as examples.
- The article recommends adding a timeout to scripts because failed jobs may never reach the completed status.
- It suggests checking permissions, regional API host, job status and offset pagination when exports fail or return incomplete results.
- The guide describes uploading exported logs to LogTotal for review.
Article Details
- Defense Focus
- Export and review Sekoia.io event data for security investigations.
- Detection Methods
- Create an event-search job with a query and time window, then retrieve matching events in pages of up to 1,000.
- Search for events associated with an alert by applying alert-related filters.
- Data Sources
- Sekoia.io event-search results
- Rule Types
- Sekoia.io dork queries
- Platforms
- Sekoia.io
- LogTotal
- Defensive Actions
- Use an API key with event-search permission; read-only access is sufficient for searching.
- Use the API host for the correct region.
- Test queries in the Events interface before using them with the API.
- For large exports, request the massive export permission and use the massive export workflow.
- Add a timeout to scripts that poll for search-job completion, and check job status if it does not finish.
- Follow offset pagination through the reported total to retrieve all events.