ReferenceWarden API

Logs & auditing (SIEM)

Security events collected from Windows and Linux devices: collection status, a summary, searching events, and one event in full.

Method	Path	Summary
GET	`/api/siem/status`	SIEM collection status
GET	`/api/siem/summary`	SIEM summary
GET	`/api/siem/events`	Search security events
GET	`/api/siem/event`	Get one security event
GET	`/api/siem/devices`	Every device in scope, with collection status and the audit policy state

#SIEM collection status

GET/api/siem/status

Address: https://<your-org>.brambleit.cloud/warden/api/siem/status
Requires: Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Response 200

Field	Type	Description
`configured`	any
`enabled`	boolean
`settings`	object
`settings.retention_days`	integer
`settings.process_creation`	boolean
`settings.powershell`	boolean
`settings.bramble_audit`	boolean
`settings.audit_policy`	boolean
`storage_full_at`	string (date-time), or null

Example response

JSON

{
  "configured": null,
  "enabled": true,
  "settings": {
    "retention_days": 1,
    "process_creation": false,
    "powershell": false,
    "bramble_audit": false,
    "audit_policy": false
  },
  "storage_full_at": "2026-11-12T09:30:00.000Z"
}

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/siem/status', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#SIEM summary

GET/api/siem/summary

Address: https://<your-org>.brambleit.cloud/warden/api/siem/summary
Requires: Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Response 200

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/siem/summary', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#Search security events

GET/api/siem/events

Address: https://<your-org>.brambleit.cloud/warden/api/siem/events
Requires: Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Query parameters

Name	Type	Description
`before`	any
`limit`	number

Response 200

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/siem/events', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#Get one security event

GET/api/siem/event

Address: https://<your-org>.brambleit.cloud/warden/api/siem/event
Requires: Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Query parameters

Name	Type	Description
`device_id`	integer
`ts`	array of any
`channel`	any
`record_id`	number

Response 200

Errors

Status	Message
404	Not found

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/siem/event', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#Every device in scope, with collection status and the audit policy state

GET/api/siem/devices

Address: https://<your-org>.brambleit.cloud/warden/api/siem/devices
Requires: Signed-in browser session (the sso_session / session_id cookies from Bramble sign-in).
Licence: Warden.

Response 200

Field	Type	Description
`devices`	array of object
`devices[].device_id`	integer
`devices[].name`	string
`devices[].os_type`	string
`devices[].agent_version`	any
`devices[].site_name`	string
`devices[].online`	boolean
`devices[].excluded`	boolean
`min_agent`	object
`min_agent.windows`	string
`min_agent.linux`	string
`audit_subcategories`	array of object
`audit_subcategories[].guid`	any
`audit_subcategories[].name`	string
`audit_subcategories[].success`	boolean
`audit_subcategories[].failure`	boolean

Example response

JSON

{
  "devices": [
    {
      "device_id": 7,
      "name": "Example name",
      "os_type": "string",
      "agent_version": null,
      "site_name": "Example site name",
      "online": false,
      "excluded": false,
      "…state.get(d.device_id) |": "…"
    }
  ],
  "min_agent": {
    "windows": "string",
    "linux": "string"
  },
  "audit_subcategories": [
    {
      "guid": null,
      "name": "Example name",
      "success": true,
      "failure": false
    }
  ]
}

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/warden/api/siem/devices', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

Was this page helpful?