The api/audit/sessions/<session-id>/alerts endpoint lists the alerts triggered in a session (if any). For details on configuring alerts, see Real-time content monitoring with Content Policies.

An event is listed as alert only if the Actions > Store in Connection Database option is selected in the Content Policy used to handle the session.

URL

GET https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command lists the alerts of a session.

curl --cookie cookies "https://<IP-address-of-SPS>/api/audit/sessions/<session-id>/alerts"

Response

The following is a sample response received when listing the alerts of a session.

For details of the meta object, see Message format.

{
    "items": [
        {
            "alert_type": "adp.event.command",
            "channel_id": "0",
            "matched_action": "ls",
            "matched_content": "[myuser@examplehost ~]$ ls",
            "matched_regexp": "ls",
            "record_id": 94,
            "rule_name": "PatternMatcherRule",
            "time": "2017-04-25T13:26:39.144356"
        },
        {
            "alert_type": "adp.event.command",
            "channel_id": "0",
            "matched_action": "man man",
            "matched_content": "[myuser@examplehost ~]$ man man",
            "matched_regexp": "man",
            "record_id": 197,
            "rule_name": "PatternMatcherRule",
            "time": "2017-04-25T13:34:15.265411"
        }
    ],
    "meta": {
        "first": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
        "href": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts",
        "last": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16/alerts?limit=500&offset=0",
        "limit": 500,
        "match_count": 3,
        "next": null,
        "offset": 0,
        "parent": "/api/audit/sessions/c7e51cebad1a3e2ade480909f7687b16",
        "previous": null,
        "remaining_seconds": 600
    }
}

Element		Type	Description
items		list	Top level element, a list containing the alerts of the session.
	alert_type	string	The type of the event that triggered the alert. Possible values: adp.event.command: A command entered in SSH or Telnet. adp.event.screen.content: Alert triggered by the screen content. adp.event.screen.creditcard: Credit card numbers detected. Displayed only as an alert, not visible in the events. adp.event.screen.windowtitle: The title of the window in graphic protocols.
	channel_id	string	The regular expression that matched the command line without prompt.
	matched_action	integer	A reference to the ID of the channel in the session where the event occurred.
	matched_content	text	The content that occurred in the session and triggered the alert. Note that this value contains the context of the match as well. For example, if a Content Policy triggers an alert if a user types the sudo command, then the psm.alerts.matched_content value contains the entire command line, including the command prompt, for example, myuser@examplehost:~$ man sudo
	matched_regexp	text	The regular expression (match field) of the Content Policy that matched a part of the content and triggered the alert. For details, see Real-time content monitoring with Content Policies.
	record_id	integer	The ID number of the alert within the session.
	rule_name	string	The name of the content policy rule that triggered the alert. Note that this is not the name of the Content Policy.
	time	string	The timestamp when the alert was triggered, for example, 2017-04-25T13:26:39.144356.

Changing the display limit

You can use the ?limit option to change the number of items displayed at once. The default limit is 500.

?limit=1000

To navigate beyond the displayed set, use the offset option.

Navigating large datasets

You can use the ?offset option to navigate data sets that extend beyond the display limit. The default value of the offset is 0, this is the initially displayed set. To move to other items beyond the initial set, increase the value to a number that corresponds to the item where you want to start displaying results from.

Example: the display limit is the default 500, and the number of sessions is 1012. The initial 500 sessions are listed at:

?offset=0

To view sessions from 501 to 1000, change the offset to 501:

?offset=501

To display the remaining 12 sessions, change the offset to 1001:

?offset=1001

Sorting and filtering

Sorting and filtering alerts is currently not supported. The items are automatically sorted by the record ID. The response includes every available field.