Pre-release. HostCraft is in testing and not yet for sale. These docs describe the current build and may change. Join the waitlist to hear when it launches.

Security API

Source: daemon/proto/hostcraft/v1/security.proto

SecurityService

SecurityService fronts the security stack: WAF, CrowdSec, malware quarantine, FIM and the security policy. REST: /api/v1/security.

Method	REST route	Permission	Streaming
`GetSecuritySummary`	`GET /api/v1/security/summary`	`SecurityEventsRead`	unary
`ListSecurityEvents`	`GET /api/v1/security/events`	`SecurityEventsRead`	unary
`GetSecurityEvent`	`GET /api/v1/security/events/{id}`	`SecurityEventsRead`	unary
`AcknowledgeSecurityEvent`	`POST /api/v1/security/events/{id}/acknowledge`	`SecurityActionsExecute`	unary
`ListBlockedIPs`	`GET /api/v1/security/blocks`	`SecurityEventsRead`	unary
`UnblockIP`	`DELETE /api/v1/security/blocks/{ip}`	`SecurityActionsExecute`	unary
`ListQuarantine`	`GET /api/v1/security/quarantine`	`SecurityQuarantineRead`	unary
`GetQuarantined`	`GET /api/v1/security/quarantine/{id}`	`SecurityQuarantineRead`	unary
`RestoreQuarantined`	`POST /api/v1/security/quarantine/{id}/restore`	`SecurityQuarantineRestore`	unary
`DeleteQuarantined`	`DELETE /api/v1/security/quarantine/{id}`	`SecurityQuarantineDelete`	unary
`TriggerScan`	`POST /api/v1/security/scan`	`SecurityScanTrigger`	unary
`GetFIMBaseline`	`GET /api/v1/security/fim/{account_id}`	`SecurityFIMRead`	unary
`AcceptFIMChanges`	`POST /api/v1/security/fim/{account_id}/accept`	`SecurityFIMAccept`	unary
`GetSecurityPolicy`	`GET /api/v1/security/policy`	`SecurityPolicyRead`	unary
`UpdateSecurityPolicy`	`PATCH /api/v1/security/policy`	`SecurityPolicyWrite`	unary

GetSecuritySummary

/hostcraft.v1.SecurityService/GetSecuritySummary

Request: GetSecuritySummaryRequest
Response: SecuritySummary

ListSecurityEvents

/hostcraft.v1.SecurityService/ListSecurityEvents

Request: ListSecurityEventsRequest
Response: ListSecurityEventsResponse

GetSecurityEvent

/hostcraft.v1.SecurityService/GetSecurityEvent

Request: GetSecurityEventRequest
Response: SecurityEvent

AcknowledgeSecurityEvent

/hostcraft.v1.SecurityService/AcknowledgeSecurityEvent

Request: AcknowledgeSecurityEventRequest
Response: SecurityEvent

ListBlockedIPs

/hostcraft.v1.SecurityService/ListBlockedIPs

Request: ListBlockedIPsRequest
Response: ListBlockedIPsResponse

UnblockIP

/hostcraft.v1.SecurityService/UnblockIP

Request: UnblockIPRequest
Response: Empty

ListQuarantine

/hostcraft.v1.SecurityService/ListQuarantine

Request: ListQuarantineRequest
Response: ListQuarantineResponse

GetQuarantined

/hostcraft.v1.SecurityService/GetQuarantined

Request: GetQuarantinedRequest
Response: QuarantineEntry

RestoreQuarantined

/hostcraft.v1.SecurityService/RestoreQuarantined

Request: RestoreQuarantinedRequest
Response: Empty

DeleteQuarantined

/hostcraft.v1.SecurityService/DeleteQuarantined

Request: DeleteQuarantinedRequest
Response: Empty

TriggerScan

/hostcraft.v1.SecurityService/TriggerScan

Request: TriggerScanRequest
Response: TriggerScanResponse

GetFIMBaseline

/hostcraft.v1.SecurityService/GetFIMBaseline

Request: GetFIMBaselineRequest
Response: FIMBaseline

AcceptFIMChanges

/hostcraft.v1.SecurityService/AcceptFIMChanges

Request: AcceptFIMChangesRequest
Response: AcceptFIMChangesResponse

GetSecurityPolicy

/hostcraft.v1.SecurityService/GetSecurityPolicy

Request: GetSecurityPolicyRequest
Response: SecurityPolicy

UpdateSecurityPolicy

/hostcraft.v1.SecurityService/UpdateSecurityPolicy

Request: UpdateSecurityPolicyRequest
Response: SecurityPolicy

Messages

AcceptFIMChangesRequest

Field	Type	Number	Description
`account_id`	`string`	1	-
`paths`	`repeated string`	2	empty accepts every pending change

AcceptFIMChangesResponse

Field	Type	Number	Description
`accepted`	`int64`	1	-

AcknowledgeSecurityEventRequest

Field	Type	Number	Description
`id`	`string`	1	-

BlockedIP

Field	Type	Number	Description
`ip`	`string`	1	-
`country`	`string`	2	-
`scenario`	`string`	3	-
`type`	`string`	4	-
`origin`	`string`	5	-
`blocked_at`	`google.protobuf.Timestamp`	6	-
`expires_at`	`google.protobuf.Timestamp`	7	-

DeleteQuarantinedRequest

Field	Type	Number	Description
`id`	`string`	1	-

Empty

Empty is returned by RPCs whose REST route answers with an empty object or 204 No Content.

No fields.

FIMBaseline

Field	Type	Number	Description
`account_id`	`string`	1	-
`captured_at`	`google.protobuf.Timestamp`	2	-
`file_count`	`int64`	3	-
`total_size_bytes`	`int64`	4	-
`pending`	`repeated FIMPendingChange`	5	-

FIMPendingChange

Field	Type	Number	Description
`id`	`string`	1	-
`path`	`string`	2	-
`kind`	`string`	3	-
`old_sha256`	`string`	4	-
`new_sha256`	`string`	5	-
`detected_at`	`google.protobuf.Timestamp`	6	-

GetFIMBaselineRequest

Field	Type	Number	Description
`account_id`	`string`	1	-

GetQuarantinedRequest

Field	Type	Number	Description
`id`	`string`	1	-

GetSecurityEventRequest

Field	Type	Number	Description
`id`	`string`	1	-

GetSecurityPolicyRequest

Field	Type	Number	Description
`scope`	`string`	1	-

GetSecuritySummaryRequest

No fields.

ListBlockedIPsRequest

No fields.

ListBlockedIPsResponse

Field	Type	Number	Description
`blocks`	`repeated BlockedIP`	1	-

ListQuarantineRequest

Field	Type	Number	Description
`account_id`	`string`	1	-

ListQuarantineResponse

Field	Type	Number	Description
`entries`	`repeated QuarantineEntry`	1	-

ListSecurityEventsRequest

Field	Type	Number	Description
`component`	`string`	1	waf \| crowdsec \| malware \| rasp \| fim \| network
`account_id`	`string`	2	-
`limit`	`int64`	3	-
`offset`	`int64`	4	-
`since`	`string`	5	RFC 3339

ListSecurityEventsResponse

Field	Type	Number	Description
`events`	`repeated SecurityEvent`	1	-

QuarantineEntry

Field	Type	Number	Description
`id`	`string`	1	-
`account_id`	`string`	2	-
`original_path`	`string`	3	-
`quarantine_path`	`string`	4	-
`size_bytes`	`int64`	5	-
`detection`	`string`	6	-
`scanner`	`string`	7	-
`quarantined_at`	`google.protobuf.Timestamp`	8	-
`restored_at`	`google.protobuf.Timestamp`	9	-
`deleted_at`	`google.protobuf.Timestamp`	10	-

RestoreQuarantinedRequest

Field	Type	Number	Description
`id`	`string`	1	-
`force`	`bool`	2	-

SecurityComponents

Field	Type	Number	Description
`waf_enabled`	`bool`	1	-
`crowdsec_enabled`	`bool`	2	-
`malware_enabled`	`bool`	3	-
`rasp_enabled`	`bool`	4	-
`fim_enabled`	`bool`	5	-
`network_enabled`	`bool`	6	-

SecurityEvent

Field	Type	Number	Description
`id`	`string`	1	-
`component`	`string`	2	-
`severity`	`string`	3	-
`source_ip`	`string`	4	-
`source_country`	`string`	5	-
`target_account_id`	`string`	6	-
`target_site_id`	`string`	7	-
`rule`	`string`	8	-
`detail`	`string`	9	-
`at`	`google.protobuf.Timestamp`	10	-
`acknowledged_at`	`google.protobuf.Timestamp`	11	-
`acknowledged_by`	`string`	12	-

SecurityHealth

Field	Type	Number	Description
`level`	`string`	1	-
`detail`	`string`	2	-
`checked_at`	`google.protobuf.Timestamp`	3	-

SecurityPolicy

Field	Type	Number	Description
`scope`	`string`	1	-
`auto_quarantine`	`bool`	2	-
`auto_delete_quarantine`	`bool`	3	-
`quarantine_retention_days`	`int64`	4	-
`fim_alert_threshold`	`int64`	5	-
`waf_throttle_threshold`	`int64`	6	-
`components`	`SecurityComponents`	7	-
`rule_actions`	`map<string, string>`	8	rule id -> alert \| throttle \| block \| suspend

SecuritySummary

Field	Type	Number	Description
`events_24h`	`int64`	1	-
`blocks_24h`	`int64`	2	-
`malware_quarantined`	`int64`	3	-
`fim_alerts_pending`	`int64`	4	-
`outbound_alerts_24h`	`int64`	5	-
`generated_at`	`google.protobuf.Timestamp`	6	-
`waf_health`	`SecurityHealth`	7	-
`crowdsec_health`	`SecurityHealth`	8	-
`malware_health`	`SecurityHealth`	9	-
`rasp_health`	`SecurityHealth`	10	-
`fim_health`	`SecurityHealth`	11	-
`network_health`	`SecurityHealth`	12	-

TriggerScanRequest

Field	Type	Number	Description
`account_id`	`string`	1	-
`scope`	`string`	2	-

TriggerScanResponse

Field	Type	Number	Description
`scan_id`	`string`	1	-

UnblockIPRequest

Field	Type	Number	Description
`ip`	`string`	1	-
`reason`	`string`	2	-

UpdateSecurityPolicyRequest

Field	Type	Number	Description
`scope`	`string`	1	-
`auto_quarantine`	`optional bool`	2	-
`auto_delete_quarantine`	`optional bool`	3	-
`quarantine_retention_days`	`optional int64`	4	-
`fim_alert_threshold`	`optional int64`	5	-
`waf_throttle_threshold`	`optional int64`	6	-
`components`	`SecurityComponents`	7	-
`rule_actions`	`map<string, string>`	8	-