Send a security event to INI-ICAM.

Syntax

Options

profile=PROFILE

Required. Name of the INI-ICAM connect profile to use for authentication

severity=SEVERITY

Required. Event severity level (0~10, higher value means more critical)

src-ip=SRC-IP

Optional. Source IP address where the event originated (e.g. 192.168.1.100)

dst-ip=DST-IP

Optional. Destination IP address targeted by the event (e.g. 10.0.0.1)

dst-port=DST-PORT

Optional. Destination port number targeted by the event (e.g. 443)

user=USER

Optional. ICAM-registered user identifier associated with the event. Must match an existing ICAM user for the score to be applied. If omitted or unrecognized, the event is accepted (HTTP 200) but not reflected in the user's score.

category=CATEGORY

Required. Event category or type that classifies the security event (e.g. malware, authentication)

msg=MSG

Optional. Detailed description or message explaining the content of the security event

time=TIME

Optional. Time the event occurred (was detected), as a 'yyyy-MM-dd HH:mm:ss' formatted string in server time zone (e.g. 2026-07-24 19:00:00). Sent to ICAM as an ISO8601 UTC datetime. If omitted, the time ICAM received the event is used.

id=ID

Optional. Event type code — the detailed event identifier defined by the sending tool (e.g. trojan_quarantined).

dry-run=DRY-RUN

Optional. Dry run mode — validates options without sending to ICAM (t or f, default: t)

Output Fields