# Picus Customer API Documentation

> Documentation for Picus Customer API

## Guides
- [Documentation](https://apidocs.picussecurity.com/docs.md): Picus Customer API documentation

## API Reference
- [# Regenerating refresh token](https://apidocs.picussecurity.com/reference/regeneraterefreshtokenparam.md): This endpoint regenerates refresh token. Invalidates previous refresh/access token. When provided refresh token is expired, a new refresh token should be created from the application itself
- [# Getting access token for endpoints](https://apidocs.picussecurity.com/reference/authtokenparam.md): OAuth2 protocol is used to authorize Refresh/Access tokens. To obtain the API, you should generate a refresh token and then request an access token using the /v1/auth/token endpoint. The refresh token will be valid for 6 months, whereas the access token will be available for 2 hours. After getting the access token, add Authorization: Bearer {accessToken} to the header to request access to the below endpoints.
- [# Get activity logs](https://apidocs.picussecurity.com/reference/activitylogsfilterparams.md): This endpoint return activity logs.
- [# Get Users](https://apidocs.picussecurity.com/reference/usersfilterparams.md): User; Email, User ID, Assigned Role, Role ID, Name, Surname, IsActive Status.
- [# Invite User](https://apidocs.picussecurity.com/reference/inviteuserparams.md): Invite User; Email, Role ID, Login Type
- [# Get Roles](https://apidocs.picussecurity.com/reference/rolesfilterparams.md): Roles; Role ID, Role Name
- [# Delete User](https://apidocs.picussecurity.com/reference/deleteuserfilterparams.md): Delete User; User ID, Success Status
- [# Assign Role](https://apidocs.picussecurity.com/reference/assignroleparams.md): Assign Role; User ID, Role ID
- [# Agent List](https://apidocs.picussecurity.com/reference/result.md): Agents; Agent Name, Agent Status, Agent Type, Agent Created Time, Agent Platform
- [# Agent Detail](https://apidocs.picussecurity.com/reference/agentparams.md): Agent Detail; Agent Name, Agent Status, Agent Type, Agent Created Time, Agent Platform, Agent Mitigation Devices, Agent Attack Modules
- [# Download Link](https://apidocs.picussecurity.com/reference/downloadlinkparams.md): Returns the download link for the given agent type and variant. Variants can be portable or installable for windows agent type, 32bit or 64bit for linux agent type and apple or intel for macos agent type.
- [# Install Token](https://apidocs.picussecurity.com/reference/installtokenparams.md): Returns the install token for the given agent type and variant. Variants can be portable or installable for windows agent type, 32bit or 64bit for linux agent type and apple or intel for macos agent type. If agent type is kubernetes, variant is not required.
- [# Reinstall Token](https://apidocs.picussecurity.com/reference/reinstalltokenparams.md): Returns the reinstall token for the given agent type and variant. Variants can be portable or installable for windows agent type, 32bit or 64bit for linux agent type and apple or intel for macos agent type.
- [# Download Kubernetes agent YAML](https://apidocs.picussecurity.com/reference/downloadk8sagentyamlparams.md): Downloads the Kubernetes agent YAML file for the given agent name and agent ID.
- [# Integrations](https://apidocs.picussecurity.com/reference/integrationlist.md): Integration List; Integration ID, Integration Name, Created At, Updated At, Health Status, Integration Agent ID, Integration Agent Name (If Available)
- [# Integration Agents](https://apidocs.picussecurity.com/reference/integrationagent.md): Integration Agent List; Integration Agent ID, Integration Agent Name, Created At, Updated At, Status (Alive | Dead), Is Installed, Is Token Expired
- [# Detection Content Sources](https://apidocs.picussecurity.com/reference/contentsources.md): Returns the detection content sources associated with the account.
- [# Detection Content Log Sources](https://apidocs.picussecurity.com/reference/contentsourcenameuriparam.md): Returns the log sources of the account for the provided content source.
- [# Detection Content Rules](https://apidocs.picussecurity.com/reference/detectioncontentrulesparams.md): Returns the rules of the account for the provided content source.
- [# Detection Content Rule Details](https://apidocs.picussecurity.com/reference/contentsourcenameandruleiduriparam.md): Returns the details of the detection content rule for the given ruleId and content source.
- [Signature List; Signature Id, Signature Name, Vendor Severity, Signature Category, Signature Version,](https://apidocs.picussecurity.com/reference/signaturelistparams.md): Description. Reference, Product Platform, Product Version
- [# Generic Not Blocked Actions List](https://apidocs.picussecurity.com/reference/genericnotblockedactionsparams.md): Returns a list of not blocked actions for generic mitigations with their associated signatures and recommendations. The response includes action details, attack module, category, and mitigation information.
- [# Device Stats](https://apidocs.picussecurity.com/reference/devicestatsbyidparams.md): Returns statistics for a specific mitigation device including Blocked Count, Not Blocked Count, Total Count, and Score.  This endpoint works together with GET /v2/mitigation/devices to replace the deprecated V1 endpoint. First retrieve the device list, then use this endpoint to get stats for each device as needed.  Example workflow:**  1. Call GET /v2/mitigation/devices to get the list of devices  2. Call GET /v2/mitigation/devices/{DeviceId} to get stats for a specific device
- [# Device List](https://apidocs.picussecurity.com/reference/devicelistparamsv2.md): Returns a list of mitigation devices.
- [# Devices' Stats List (deprecated)](https://apidocs.picussecurity.com/reference/devicelistparams.md): Deprecated: This endpoint has been deprecated and is no longer available. Please migrate to the V2 endpoints: `GET /v2/mitigation/devices` - Returns device list `GET /v2/mitigation/devices/{DeviceId}` - Returns stats for a specific device
- [# List Custom Detection Content](https://apidocs.picussecurity.com/reference/getcustomdetectioncontentparams.md): Lists custom detection content items for the account.
- [# Create Custom Detection Content](https://apidocs.picussecurity.com/reference/createcustomdetectioncontentparams.md): Creates custom detection content items for the account.
- [# Get Custom Detection Content By ID](https://apidocs.picussecurity.com/reference/getcustomdetectioncontentbyidparams.md): Returns a custom detection content item by its ID.
- [# Update Custom Detection Content](https://apidocs.picussecurity.com/reference/updatecustomdetectioncontentparams.md): Updates a custom detection content item by ID.
- [# Delete Custom Detection Content](https://apidocs.picussecurity.com/reference/deletecustomdetectioncontentparams.md): Deletes a custom detection content item by ID.
- [# Get Detection Content Devices](https://apidocs.picussecurity.com/reference/getdetectiondevicesparams.md): Returns all available detection content devices (e.g. Splunk, QRadar). Used to populate device selection when creating custom detection content.
- [# Get MITRE ATT&CK Sub-Techniques](https://apidocs.picussecurity.com/reference/getmitresubtechniquesparams.md): Returns all available MITRE ATT&CK sub-techniques with their parent technique reference. Used to populate sub-technique selection when creating custom detection content.
- [# Get MITRE ATT&CK Tactics](https://apidocs.picussecurity.com/reference/getmitretacticsparams.md): Returns all available MITRE ATT&CK tactics. Used to populate tactic selection when creating custom detection content.
- [# Get MITRE ATT&CK Techniques](https://apidocs.picussecurity.com/reference/getmitretechniquesparams.md): Returns all available MITRE ATT&CK techniques. Used to populate technique selection when creating custom detection content.
- [# Simulation List](https://apidocs.picussecurity.com/reference/simulationlistparams.md): Simulation List; Simulation ID, Simulation Name, Simulation Agent (with status), Enrichment Status, Last Prevention Result, Last Detection Result (if Available) Default limit: 25, Default offset: 0 Max limit: 50
- [# Create Simulation](https://apidocs.picussecurity.com/reference/createsimulationparams.md): Creates the simulation with given information
- [# Simulation Detail](https://apidocs.picussecurity.com/reference/simulationparams.md): Simulation Detail; Simulation Name, Simulation Agent (with status), Enrichment Status, Last Prevention Result, Last Detection Result (if Available), Simulation Run List
- [# Update Simulation](https://apidocs.picussecurity.com/reference/updatesimulationparams.md): Updates the simulation with given information
- [# Delete Simulation](https://apidocs.picussecurity.com/reference/simulationdeleteparams.md): Deletes simulation with given id
- [# Cancel Simulation](https://apidocs.picussecurity.com/reference/simulationcancelparams.md): Cancels simulation with given id if it is running
- [# Simulate Now](https://apidocs.picussecurity.com/reference/simulatenowparams.md): ReRuns simulation with given id
- [# Latest Simulation Run Result](https://apidocs.picussecurity.com/reference/latestrunparams.md): Includes Prevention and Detection result details Prevention Result: Total Threats, Blocked/Not Blocked, Attackers Objective, UnAchieved/Achieved Count Detection Result: Logged/Not Logged, Alerted/Not Alerted Count
- [Latest Simulation Run Result with Mitre ATT&CK and Unified Kill Chain framework](https://apidocs.picussecurity.com/reference/latestrundetailparams.md): Latest Simulation Run Result with Mitre ATT&CK and Unified Kill Chain framework
- [# Threats - Objectives - Actions](https://apidocs.picussecurity.com/reference/latestrunthreatparams.md): Includes Threat, Attacker's Objective, Action results for Prevention and Threat, Action results for Detection. Default limit: 10, Default offset: 0 Max limit: 50
- [# Action Details List](https://apidocs.picussecurity.com/reference/latestactiondetailslistparams.md): Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1). Protocol based results are also available.
- [# Action Details](https://apidocs.picussecurity.com/reference/latestactiondetailsparams.md): Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1). Protocol based results are also available.
- [# Integration based Alert Details for Actions](https://apidocs.picussecurity.com/reference/latestactionalertsparams.md): Includes Action Name, Log Source and Alert Time. Default limit: 100, Default offset: 0 Max limit: 1000 Same action can be used multiple times under the scope of threat where these actions are distinguished by node_id node_id parameter can be used optionally. For the case it is not provided, first node is returned.
- [# Integration based Log Details for Actions](https://apidocs.picussecurity.com/reference/latestactionlogsparams.md): Includes Action Name, Log Source and Alert Time. Default limit: 100, Default offset: 0 Max limit: 1000 Same action can be used multiple times under the scope of threat where these actions are distinguished by node_id node_id parameter can be used optionally. For the case it is not provided, first node is returned.
- [# Simulation Run Result](https://apidocs.picussecurity.com/reference/simulationrunparams.md): Includes Prevention and Detection result details Prevention Result: Total Threats, Blocked/Not Blocked, Attackers Objective, UnAchieved/Achieved Count Detection Result: Logged/Not Logged, Alerted/Not Alerted Count
- [Simulation Run Result with Mitre ATT&CK and Unified Kill Chain framework](https://apidocs.picussecurity.com/reference/rundetailparams.md): Simulation Run Result with Mitre ATT&CK and Unified Kill Chain framework
- [# Threats - Objectives - Actions](https://apidocs.picussecurity.com/reference/runthreatparams.md): Includes Threat, Attacker's Objective, Action results for Prevention and Threat, Action results for Detection Default limit: 10, Default offset: 0 Max limit: 50
- [# Action Details List](https://apidocs.picussecurity.com/reference/actiondetailslistparams.md): Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1) for the actions of the given threat. Protocol based results are also available.
- [# Action Details](https://apidocs.picussecurity.com/reference/actiondetailsparams.md): Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1). Protocol based results are also available.
- [# Integration based Alert Details for Actions](https://apidocs.picussecurity.com/reference/actionalertsparams.md): Includes Action Name, Log Source and Alert Time. Default limit: 100, Default offset: 0 Max limit: 1000 Same action can be used multiple times under the scope of threat where these actions are distinguished by node_id node_id parameter can be used optionally. For the case it is not provided, first node is returned.
- [# Integration based Log Details for Actions](https://apidocs.picussecurity.com/reference/actionlogsparams.md): Includes Action Name, Log Source and Log Time. Default limit: 100, Default offset: 0 Max limit: 1000 Same action can be used multiple times under the scope of threat where these actions are distinguished by node_id node_id parameter can be used optionally. For the case it is not provided, first node is returned.
- [# Raw Log File Links](https://apidocs.picussecurity.com/reference/rawlogsparams.md): Retrieves raw log file download links for a specific threat, peer, and integration combination. Returns an array of URLs pointing to raw log files that can be downloaded.
- [# Summary Overall](https://apidocs.picussecurity.com/reference/summaryoverallparams.md): This endpoint is used to get the overall summary of the account.
- [# Template List](https://apidocs.picussecurity.com/reference/templatelistparams.md): Templates; Template Name, Description, Id, Threat Count, Content Type, Category Name, Subcategory Name
- [# Create Template](https://apidocs.picussecurity.com/reference/createtemplateparams.md): Creates the dynamic/static templates with given threats or rule content
- [# Template Detail](https://apidocs.picussecurity.com/reference/templateparams.md): Template Detail; Template Name, Description, Id, Content Type, Category Name, Subcategory Name Applicable Agent Types, Rules For Dynamic Templates, Threat List
- [# Action Parameters](https://apidocs.picussecurity.com/reference/actionparametersparams.md): This endpoint returns all available parameters required to create an action. It provides the complete configuration schema, including supported fields, available option values, and related metadata necessary for action creation.
- [# Action List](https://apidocs.picussecurity.com/reference/actionlistparams.md): Action List; Action Id, Action Display Id, Updated At, Action Name Default limit: 100, Default offset: 0 Max limit: 100
- [# CreateAction](https://apidocs.picussecurity.com/reference/createactionparams.md): Creates custom actions with given arguments
- [# Action Details](https://apidocs.picussecurity.com/reference/actiondetails.md): Action Details; Action Id, Action Display Id, Action Name, Action Release Date, Action Description, Action Affected Os, Action Affected Products, Action Affected Platforms, Action Category, Attack Module, Mitres, Unified Kill Chains, Module Based Details, Owasp, Reference Links, Keyword Queries
- [# Files List](https://apidocs.picussecurity.com/reference/fileslistparams.md): Files List; Default limit: 100, Default offset: 0 Max limit: 100
- [# Process List](https://apidocs.picussecurity.com/reference/processlistparams.md): Processes; Default limit: 100, Default offset: 0 Max limit: 100
- [# Create Process](https://apidocs.picussecurity.com/reference/createprocessparams.md): Creates custom processes with given arguments
- [# Threat List](https://apidocs.picussecurity.com/reference/threatlistparams.md): Threat List; Threat ID, Threat Display ID, Threat Name,  Release Date, Severity, Tags, Affected Operating Systems, Is Predefined, Attack Categories, Attack Module Ids, Unified Kill Chain Phases, Mitres
- [# List Tags](https://apidocs.picussecurity.com/reference/tags.md): List tags for threats
- [# Threat Details](https://apidocs.picussecurity.com/reference/threatdetails.md): Threat Details; Threat ID, Threat Display ID, Threat Name,  Release Date, Severity, Tags, Affected Operating Systems, Is Predefined, Attack Categories, Attack Module Ids, Unified Kill Chain Phases, Mitres, Threat Description, Affected Products, Action Category Id, Applicable Agent Types, Objective Flows, Threat Actors
- [# List Threat Actors](https://apidocs.picussecurity.com/reference/threat-actors.md): List threat actors
- [# Create Threat](https://apidocs.picussecurity.com/reference/createthreatparams.md): Creates custom threats with given arguments
- [# Update Threat](https://apidocs.picussecurity.com/reference/updatethreatparams.md): Updates custom threats with given arguments
- [# Delete Threat](https://apidocs.picussecurity.com/reference/deletethreatparams.md): Deletes custom threats with given threat ID
- [# Action Details List](https://apidocs.picussecurity.com/reference/actiondetailslist.md): Action Details; Action Id, Action Display Id, Action Name, Action Release Date, Action Description, Action Affected Os, Action Affected Products, Action Affected Platforms, Action Category, Attack Module, Mitres, Unified Kill Chains, Module Based Details, Owasp, Reference Links, Keyword Queries
- [# Custom Action Keyword](https://apidocs.picussecurity.com/reference/customactionkeywordparams.md): Generates the detection keyword (query) for a custom action based on the given attack module and its related fields (file hashes, file name, play process ids, url or action id). The returned keyword can then be passed to the Create Action endpoint.
- [# Upload File](https://apidocs.picussecurity.com/reference/fileuploadparams.md): Uploads a file that can later be referenced when creating custom actions or processes. The file must be sent as multipart/form-data under the "file" field.
- [# Import Threat Pack](https://apidocs.picussecurity.com/reference/importthreatparams.md): Imports a threat pack from a YAML file or an encrypted zip archive containing a YAML definition and optional payload files. Returns the created threat details. For detailed information on how to construct the threat file, please refer to the guide at https://support.picussecurity.com/hc/en-us/articles/36765648951837.
- [# Export Threat Pack](https://apidocs.picussecurity.com/reference/exportthreatparams.md): Exports a custom threat as an encrypted zip file containing the threat definition and any associated files. The response is a binary file download.
- [# Generate Simulation Report](https://apidocs.picussecurity.com/reference/generatesimulationreportparams.md): Generates a report for the specified simulation. The report can either provide an overview or focus on a specific run of the simulation, depending on the parameters.
- [# Simulation Result Report Detail](https://apidocs.picussecurity.com/reference/reportparams.md): Get details for simulation result report by report id
- [# Simulation Result Report Download Url](https://apidocs.picussecurity.com/reference/reportdownloadurlparams.md): Get download url for a simulation result report by id
- [# Download Simulation Result Report](https://apidocs.picussecurity.com/reference/reportdownloadparams.md): Downloads a simulation result report file by id. This endpoint is used in on-prem deployments where users cannot access S3 directly. The file is returned as binary content with appropriate Content-Disposition header.
- [# List Instance Scores](https://apidocs.picussecurity.com/reference/listinstancescoresparams.md): Returns exposure instance scores for the specified host-exposure pairs. Duplicate pairs are deduplicated server-side. Unmatched pairs are omitted from the response.

## Recipes
- [Authentication ( Refresh & Access Token )](https://apidocs.picussecurity.com/recipes/authentication-refresh-access-token.md)
- [Create Simulation Results Report in CSV format using Rest API Endpoints](https://apidocs.picussecurity.com/recipes/create-simulation-results-report-in-csv-format-using-rest-api-endpoints.md)
- [Fetch Picus Security activity logs](https://apidocs.picussecurity.com/recipes/fetch-picus-security-activity-logs.md)