Retrieve historical events about your software collection

This endpoint returns historical information about your stored files, including creation, deletion, detections, and clean-ups.

A dictionary with data, links, and meta properties is received.

Events will be listed in dictionary format with the following fields:

Field Name	Description	Possible Values
action	A keyword describing the action that the event is describing	CLEAN COMMENT DELETE DETECTED UPLOAD RESOLVED
creator_id	Username. Who uploaded the file.
details	A list of strings detailing current and previous engine verdicts.	Composed of four parts with a ':' separator: engine current \| last signature \| update \| version \| malicious \| visible <value> For example: engine:current:update:20191016 engine:last:signature:<signature>
level	Severity level for the event.	0 (lowest) to 4 (highest)
monitor_key	The key of the monitor item.
owner_id	The group that owns the monitor item.
plaintext_description	A space-separated collection of keywords containing sha256, detecting engines, and file names.	Not always present
source	The action originating or triggering this event.	ANALYSIS FILE QUOTA
subject	If applicable, the SHA256 of the file.
timestamp	Timestamp in the format YYYYMMDDTHH:mm:ss

{
  "data": [
    {
      action: "CLEAN",
      creator_id: "wcoyote",
      details: [
        {
          "v": "engine:current:clean"
        }
      ],
      level: "1",
      monitor_key: "abcdcdcedef928492384==",
      owner_id: "monitor_group_here",
      plaintext_description: "",
      source: "FILE",
      subject: "sha256_here",
      timestamp: "2019-12-31T23:58:58",
    },
    {
      action: "DETECTED",
      creator_id: "wcoyote",
      details: [
        {
          "v": "engine:current:malicious:ENGINE_ONE"
        },
        {
          "v": "engine:current:malicious:ENGINE_TWO"
        },
      ],
      level: "1",
      monitor_key: "abcdcdcedef928492384==",
      owner_id: "monitor_group_here",
      plaintext_description: "ENGINE_ONE <sha256> <filename>",
      source: "ANALYSIS",
      subject: "sha256_here",
      timestamp: "2019-12-31T23:58:58",
    }
  ],
  "links": {
  	"next": "https://www.virustotal.com/api/v3/monitor/events?cursor=ABCDE123456%3D%3D",
    "self": "https://www.virustotal.com/api/v3/monitor/events"
  },
  "meta": {
  	"cursor": "ABCDE123456==",
    "job_id": "foobar"
  }
}

200200