opensearch

Sentivex Evolution Engine API

POST/opensearch_search

OpenSearch 범용 검색 프록시(쿼리 DSL)

ocsf-* 인덱스 검색. 빈 쿼리면 최근 size개. 쿼리가 있으면 multi_match.

Request body

querystring | null
index_patternstring
sizeinteger
offsetinteger
aggsobject | null
track_totalboolean

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X POST https://see.in-bridge.com/opensearch_search \
  -H "Content-Type: application/json" \
  -d '{"query":"string","index_pattern":"string","size":0,"offset":0,"aggs":null,"track_total":true}'
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_search", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "query": "string",
    "index_pattern": "string",
    "size": 0,
    "offset": 0,
    "aggs": null,
    "track_total": true
  })
});
const data = await res.json();
Response 200
{}
POST/opensearch_incidents

인시던트 목록 검색

벤더 인시던트 인덱스 페이징 + 필터. source: ocsf | crowdstrike | sentinelone | symantec_wrapped 응답: {source, total, hits: [{ uid, time, severity, status, message, tenant, doc, ... }]}

Request body

sourcestring
querystring | null
tenantstring | null
tenantsstring[] | string | null
severitystring | null
statusstring | null
vendorstring | null
frominteger
sizeinteger
sort_fieldstring | null
sort_orderstring
since_minutesinteger | null
time_fromstring | null
time_tostring | null
datestring | null
dateTzstring
fromMsinteger | string | null
toMsinteger | string | null
date_modestring

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X POST https://see.in-bridge.com/opensearch_incidents \
  -H "Content-Type: application/json" \
  -d '{"source":"string","query":"string","tenant":"string","tenants":"string","severity":"string","status":"string","vendor":"string","from":0,"size":0,"sort_field":"string","sort_order":"string","since_minutes":0}'
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_incidents", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "source": "string",
    "query": "string",
    "tenant": "string",
    "tenants": "string",
    "severity": "string",
    "status": "string",
    "vendor": "string",
    "from": 0,
    "size": 0,
    "sort_field": "string",
    "sort_order": "string",
    "since_minutes": 0
  })
});
const data = await res.json();
Response 200
{}
POST/opensearch_alerts

알럿 목록 검색

벤더별 alert 인덱스 페이징. source 동일 (ocsf|crowdstrike|sentinelone|symantec_wrapped|cortex_xdr).

Request body

sourcestring
querystring | null
tenantstring | null
tenantsstring[] | string | null
severitystring | null
statusstring | null
vendorstring | null
frominteger
sizeinteger
sort_fieldstring | null
sort_orderstring
since_minutesinteger | null
time_fromstring | null
time_tostring | null
datestring | null
dateTzstring
fromMsinteger | string | null
toMsinteger | string | null
date_modestring

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X POST https://see.in-bridge.com/opensearch_alerts \
  -H "Content-Type: application/json" \
  -d '{"source":"string","query":"string","tenant":"string","tenants":"string","severity":"string","status":"string","vendor":"string","from":0,"size":0,"sort_field":"string","sort_order":"string","since_minutes":0}'
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_alerts", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "source": "string",
    "query": "string",
    "tenant": "string",
    "tenants": "string",
    "severity": "string",
    "status": "string",
    "vendor": "string",
    "from": 0,
    "size": 0,
    "sort_field": "string",
    "sort_order": "string",
    "since_minutes": 0
  })
});
const data = await res.json();
Response 200
{}
POST/opensearch_endpoints

엔드포인트 목록 검색

벤더별 endpoint(inventory) 인덱스 페이징. ENDPOINT_INDICES 매핑 기반.

Request body

sourcestring
querystring | null
tenantstring | null
tenantsstring[] | string | null
severitystring | null
statusstring | null
vendorstring | null
frominteger
sizeinteger
sort_fieldstring | null
sort_orderstring
since_minutesinteger | null
time_fromstring | null
time_tostring | null
datestring | null
dateTzstring
fromMsinteger | string | null
toMsinteger | string | null
date_modestring

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X POST https://see.in-bridge.com/opensearch_endpoints \
  -H "Content-Type: application/json" \
  -d '{"source":"string","query":"string","tenant":"string","tenants":"string","severity":"string","status":"string","vendor":"string","from":0,"size":0,"sort_field":"string","sort_order":"string","since_minutes":0}'
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_endpoints", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "source": "string",
    "query": "string",
    "tenant": "string",
    "tenants": "string",
    "severity": "string",
    "status": "string",
    "vendor": "string",
    "from": 0,
    "size": 0,
    "sort_field": "string",
    "sort_order": "string",
    "since_minutes": 0
  })
});
const data = await res.json();
Response 200
{}
GET/opensearch_alert_bundle/{alert_uid}

Opensearch Alert Bundle

Alert detail bundle — alert + 관련 incident + endpoint + hash TI + MITRE + related alerts. Vendor 별 join key 차이는 _extract_alert_joins 가 흡수.

Path parameters

alert_uidstringrequired

Query parameters

sourcestring
max_relatedinteger

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X GET https://see.in-bridge.com/opensearch_alert_bundle/{alert_uid}?source=string&max_related=0
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_alert_bundle/{alert_uid}", {
  method: "GET"
});
const data = await res.json();
Response 200
{}
GET/opensearch_endpoint_bundle/{endpoint_key}

Opensearch Endpoint Bundle

Endpoint detail bundle — endpoint + 최근 alerts + 관련 incidents + hash 집계 + MITRE summary. endpoint_key 는 endpoint_id (선호) 또는 hostname.

Path parameters

endpoint_keystringrequired

Query parameters

sourcestring
max_alertsinteger

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X GET https://see.in-bridge.com/opensearch_endpoint_bundle/{endpoint_key}?source=string&max_alerts=0
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_endpoint_bundle/{endpoint_key}", {
  method: "GET"
});
const data = await res.json();
Response 200
{}
GET/opensearch_incident_bundle_stats

Opensearch Incident Bundle Stats

Bundle LRU 캐시 통계 — hit ratio 모니터링용 (P0-A3).

Responses

200 Successful Response
object
cURL
curl -X GET https://see.in-bridge.com/opensearch_incident_bundle_stats
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_incident_bundle_stats", {
  method: "GET"
});
const data = await res.json();
Response 200
{}
POST/opensearch_incident_bundle_invalidate

Opensearch Incident Bundle Invalidate

캐시 명시 invalidate (P0-A3). uid+source 안 주면 전체 클리어.

Query parameters

incident_uidstring | null
sourcestring | null

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X POST https://see.in-bridge.com/opensearch_incident_bundle_invalidate?incident_uid=string&source=string
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_incident_bundle_invalidate", {
  method: "POST"
});
const data = await res.json();
Response 200
{}
GET/opensearch_incident_bundle/{incident_uid}

Opensearch Incident Bundle

인시던트 1건 + 관련 detection/alert 묶음 반환. source=ocsf_ds: live OCSF 데이터스트림. source=ocsf: frozen -latest 스냅샷. source=aws_security_finding: ocsf-security-finding-latest 단일 doc (P0-A1) source=crowdstrike|sentinelone|symantec_wrapped: wrapped doc 안에 alerts 내장 → 단일 인덱스 조회 no_cache=true 면 캐시 무시 (P0-A3).

Path parameters

incident_uidstringrequired

Query parameters

max_detectionsinteger
sourcestring
no_cacheboolean

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X GET https://see.in-bridge.com/opensearch_incident_bundle/{incident_uid}?max_detections=0&source=string&no_cache=true
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_incident_bundle/{incident_uid}", {
  method: "GET"
});
const data = await res.json();
Response 200
{}
GET/opensearch_doc/{uid}

Opensearch Doc

단일 OCSF doc 조회 — incidents 상세 탭 "번들" 의 detection doc lookup 용 (2026-05-30 P4-A W2). 여러 UID 필드를 should 매칭: metadata.uid / finding_info.uid / finding_info_list[].uid. 응답: {found, doc, source, uid}

Path parameters

uidstringrequired

Query parameters

sourcestring

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X GET https://see.in-bridge.com/opensearch_doc/{uid}?source=string
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_doc/{uid}", {
  method: "GET"
});
const data = await res.json();
Response 200
{}
GET/opensearch_host_bundle/{hostname}

Opensearch Host Bundle

호스트 1대의 inventory 메타 + 그 호스트가 관여한 인시던트 리스트 (벤더별 분기).

Path parameters

hostnamestringrequired

Query parameters

sourcestring
max_incidentsinteger

Responses

200 Successful Response422 Validation Error
object
cURL
curl -X GET https://see.in-bridge.com/opensearch_host_bundle/{hostname}?source=string&max_incidents=0
JavaScript
const res = await fetch("https://see.in-bridge.com/opensearch_host_bundle/{hostname}", {
  method: "GET"
});
const data = await res.json();
Response 200
{}